Shell script as binary

[Mick235711]

Output of brew config

HOMEBREW_VERSION: 4.5.2-51-g13d9d98
ORIGIN: https://github.com/Homebrew/brew
HEAD: 13d9d9803f7408ad6c8243ed6186026416b1eb4e
Last commit: 52 minutes ago
Branch: master
Core tap JSON: 13 May 21:07 UTC
Core cask tap JSON: 13 May 21:07 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.QH5h5MrUDL/org.xquartz:0
HOMEBREW_EDITOR: vimr --nvim
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.3 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.3/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 16.0.0 build 1600
Git: 2.49.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.4.1-arm64
CLT: 16.3.0.0.1.1742442376
Xcode: 16.1
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  cheatsheet
  microsoft-remote-desktop

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  icu4c@76

Warning: Putting non-prefixed coreutils in your path can cause GMP builds to fail.

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected header files:
  /usr/local/include/elf.h
  /usr/local/include/llvm-c/*

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  z3
  python-packaging
  python-setuptools
  certifi

Description of issue

Sometimes, a cask can only provide a shell script as the entry point to the GUI, which is intended to be linked into brew --prefix and launched from the command line. Examples of this include minecraft-server.rb and other things that rely only on shimscripts, as well as real casks that only provide a script as a download.
On its own, this is not a problem. However, brew audit will treat the binary argument as a real binary if it is the only artifact provided (i.e., no app or other artifact provided), which obviously fails for those shell scripts:

$ brew audit --cask --new --verbose minecraft-server
[...]
==> Downloading and extracting artifacts
==> Downloading https://launcher.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar
Already downloaded: /Users/mick/Library/Caches/Homebrew/downloads/1abc234815cf7568c94e29f242cdee6844f0e83cc55886d24f2ac6a5dba26d80--server.jar
==> Verifying checksum for '1abc234815cf7568c94e29f242cdee6844f0e83cc55886d24f2ac6a5dba26d80--server.jar'
fatal error: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/lipo: can't open input file: /private/tmp/cask-audit20250514-27658-5xepk6/minecraft-server.wrapper.sh (No such file or directory)
==> Downloading https://launcher.mojang.com/v1/objects/e6ec2f64e6080b9b5d9b471b291c33cc7f509733/server.jar
Already downloaded: /Users/mick/Library/Caches/Homebrew/downloads/1abc234815cf7568c94e29f242cdee6844f0e83cc55886d24f2ac6a5dba26d80--server.jar
==> Verifying checksum for '1abc234815cf7568c94e29f242cdee6844f0e83cc55886d24f2ac6a5dba26d80--server.jar'
audit for minecraft-server: failed
 - Signature verification failed:
/private/tmp/cask-audit20250514-27658-5xepk6/minecraft-server.wrapper.sh: No such file or directory

macOS on ARM requires software to be signed.
Please contact the upstream developer to let them know they should sign and notarize their software.
minecraft-server
  * line 5, col 2: Signature verification failed:
    /private/tmp/cask-audit20250514-27658-5xepk6/minecraft-server.wrapper.sh: No such file or directory

    macOS on ARM requires software to be signed.
    Please contact the upstream developer to let them know they should sign and notarize their software.
Error: 1 problem in 1 cask detected.

What should we do if we want to add such casks in the future?

[SMillerDev]

/private/tmp/cask-audit20250514-27658-5xepk6/minecraft-server.wrapper.sh: No such file or directory

It's a different issue than you're describing, and as far as I know the audit already skips non-binary files.

[Mick235711]

Well, if you only provide a binary "foo.sh", target: foo without other things like app, the audit does fail

lipo: can't figure out the architecture type of: foo.sh
foo.sh: code object is not signed at all

For shimscript, the error message is different, complaining about no such file or directory, since the shimscript is in preflight and has not been written yet at the verification stage. Indeed, that's a different problem, but nevertheless still an audit error that should not happen.