Summary
The same pinned-vs-mutable Homebrew install decision tree is implemented three separate times.
Details
install.sh:206-249 (install_homebrew)bootstrap.sh:340-376 (bootstrap_install_homebrew)cli/bash/commands/basectl/subcommands/setup_macos_homebrew.sh:246-306 (setup_install_homebrew)
All three implement the same SHA-256 verification and /bin/bash -c "$(curl -fsSL ...)" fallback, differing only by function-name prefix and env var names (BASE_INSTALL_DRY_RUN / BASE_BOOTSTRAP_DRY_RUN / setup's own dry-run flag).
Impact
A future security fix (e.g. tightening curl flags or verification logic) applied to one copy is easily missed in the other two, since there is no single source of truth.
Suggested fix
Extract the shared Homebrew-install decision logic into one Bash library sourced by all three entry points, similar to the existing base_first_mile_fetch_homebrew_installer helper already shared for the fetch step.
Summary
The same pinned-vs-mutable Homebrew install decision tree is implemented three separate times.
Details
install.sh:206-249(install_homebrew)bootstrap.sh:340-376(bootstrap_install_homebrew)cli/bash/commands/basectl/subcommands/setup_macos_homebrew.sh:246-306(setup_install_homebrew)All three implement the same SHA-256 verification and
/bin/bash -c "$(curl -fsSL ...)"fallback, differing only by function-name prefix and env var names (BASE_INSTALL_DRY_RUN/BASE_BOOTSTRAP_DRY_RUN/ setup's own dry-run flag).Impact
A future security fix (e.g. tightening curl flags or verification logic) applied to one copy is easily missed in the other two, since there is no single source of truth.
Suggested fix
Extract the shared Homebrew-install decision logic into one Bash library sourced by all three entry points, similar to the existing
base_first_mile_fetch_homebrew_installerhelper already shared for the fetch step.