Repository navigation
Sync the reference formula to the published 0.14.0 tap - #41
Merged
Merged
Conversation
BootIntel/homebrew-tap is at 0.14.0 (commit 1b7beba), so this copy was claiming four checksums that no longer correspond to what `brew install` fetches. The file's own header makes the case: a stale copy of a formula is worse than no copy, because it invites someone to trust the checksums in it. Body taken verbatim from the live tap rather than edited in place, and asserted byte-identical to it apart from this repo's header, which is the invariant the header asks for so a diff between the two is a real finding rather than noise. The four digests were read out of the release's SHA256SUMS, paired to platforms by matching each url line rather than assuming block order, and then verified by downloading all four assets from the URLs the formula actually uses and hashing them. All four matched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BootIntel/homebrew-tapis now at 0.14.0 (1b7beba), so this copy was claiming four checksums that no longer correspond to whatbrew installfetches. The file's own header makes the case: a stale copy of a formula is worse than no copy, because it invites someone to trust the checksums in it.The body is taken verbatim from the live tap rather than edited in place, and asserted byte-identical to it apart from this repo's header — the invariant that header asks for, so a diff between the two is a real finding rather than noise.
How the digests were obtained
Per
docs/releasing.mdstep 7, read out of the release's ownSHA256SUMSrather than transcribed, then paired to platforms by matching eachurlline rather than assuming the order of the four blocks. Then verified the way that matters: all four assets downloaded from the exact URLs the formula uses and hashed.A wrong digest makes
brew installfail with a checksum mismatch, which reads to a user like a compromised download.🤖 Generated with Claude Code