advisory-match: reuse platform-independent history

[p-linnane]

Historical revisions whose source is provably platform-independent (a plain Formula class with only literal, allowlisted DSL) are now loaded once and shared across platforms. Anything else is still evaluated on each platform.

brew benchmark --exec over a seeded replay of ansible, httpie and poetry with frozen OSV responses (3 runs): 217.3 ± 1.6 s without reuse, 197.3 ± 2.0 s with it (main: 184.8 ± 4.0 s).

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex (GPT-6 Astra) drafted the change and tests and ran brew lgtm --online; Claude Code (Opus 5.5) reviewed it, ran brew lgtm --online on this commit and ran the benchmark. I reviewed the diff.

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 63e7136c-89ad-4273-8816-63bd80ad933e

---

📥 Commits

Reviewing files that changed from the base of the PR and between 76fdf66 and 613ae9b.

---

📒 Files selected for processing (10)

• Library/Homebrew/dev-cmd/advisory-match.rb
• Library/Homebrew/formula_versions.rb
• Library/Homebrew/test/dev-cmd/advisory-match_spec.rb
• Library/Homebrew/test/vulns/history_spec.rb
• Library/Homebrew/test/vulns/match_spec.rb
• Library/Homebrew/test/vulns/platform_independence_spec.rb
• Library/Homebrew/vulns/history.rb
• Library/Homebrew/vulns/match.rb
• Library/Homebrew/vulns/platform_independence.rb
• docs/Advisory-Matching.md

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: docker (arm64 Ubuntu 24.04)
• GitHub Check: docker (arm64 Ubuntu 26.04)
• GitHub Check: docker (x86_64 Ubuntu 24.04)
• GitHub Check: docker (x86_64 Ubuntu 26.04)
• GitHub Check: tests (macOS, 2/2)
• GitHub Check: tests (load-only macOS)
• GitHub Check: tests (load-only Linux)
• GitHub Check: tests (no Sorbet)
• GitHub Check: tests (Linux, 2/2)
• GitHub Check: tests (generic OS, 1/2)
• GitHub Check: tests (online, 1/2)
• GitHub Check: tests (macOS, 1/2)
• GitHub Check: tests (Linux, 1/2)
• GitHub Check: tests (online, 2/2)
• GitHub Check: tests (generic OS, 2/2)
• GitHub Check: workflow_syntax
• GitHub Check: docs
• GitHub Check: syntax
• GitHub Check: Analyze

---

🧰 Additional context used

📚 Code guidelines (1)

docs/AGENTS.md — auto-discovered

---

📓 Path-based instructions (1)

Source excerpt: Use the system Homebrew `brew bundle exec ...`

📄 CodeRabbit inference engine (docs/AGENTS.md)

Files:

• docs/Advisory-Matching.md

---

🪛 ast-grep (0.45.3)

Library/Homebrew/test/vulns/history_spec.rb

[warning] 386-388: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.
Context: allow(Utils).to receive(:popen_read)
.with("git", "-C", requests.tap!.path.to_s, "cat-file", "blob", "#{revision}:#{source_path}", safe: true)
.and_return(source)
Note: [CWE-798]: Use of Hard-coded Credentials [OWASP A07:2021]: Identification and Authentication Failures

(hardcoded-secret-rsa-passphrase-ruby)

---

[warning] 386-387: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.
Context: receive(:popen_read)
.with("git", "-C", requests.tap!.path.to_s, "cat-file", "blob", "#{revision}:#{source_path}", safe: true)
Note: [CWE-798]: Use of Hard-coded Credentials [OWASP A07:2021]: Identification and Authentication Failures

(hardcoded-secret-rsa-passphrase-ruby)

---

[warning] 390-392: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.
Context: allow(Utils).to receive(:popen_read)
.with("git", "-C", requests.tap!.path.to_s, "diff-tree", "--root", "--no-commit-id", "--name-only",
"--find-renames", "--diff-filter=AR", "-r", "old", safe: true).and_return("#{source_path}\n")
Note: [CWE-798]: Use of Hard-coded Credentials [OWASP A07:2021]: Identification and Authentication Failures

(hardcoded-secret-rsa-passphrase-ruby)

---

[warning] 390-392: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file.
Context: receive(:popen_read)
.with("git", "-C", requests.tap!.path.to_s, "diff-tree", "--root", "--no-commit-id", "--name-only",
"--find-renames", "--diff-filter=AR", "-r", "old", safe: true)
Note: [CWE-798]: Use of Hard-coded Credentials [OWASP A07:2021]: Identification and Authentication Failures

(hardcoded-secret-rsa-passphrase-ruby)

---

🔇 Additional comments (10)

Library/Homebrew/vulns/platform_independence.rb (1)

1-110: LGTM!

---

Library/Homebrew/test/vulns/platform_independence_spec.rb (1)

1-196: LGTM!

---

Library/Homebrew/formula_versions.rb (1)

360-376: LGTM!

---

Library/Homebrew/vulns/history.rb (1)

97-118: LGTM!

---

Library/Homebrew/test/vulns/history_spec.rb (1)

365-556: LGTM!

---

Library/Homebrew/vulns/match.rb (1)

964-980: LGTM!

---

Library/Homebrew/test/vulns/match_spec.rb (1)

2503-2554: LGTM!

---

Library/Homebrew/dev-cmd/advisory-match.rb (1)

312-331: LGTM!

---

Library/Homebrew/test/dev-cmd/advisory-match_spec.rb (1)

1437-1467: LGTM!

---

docs/Advisory-Matching.md (1)

53-58: LGTM!

---

---

📝 Summary

Summary by CodeRabbit

• Performance
  • Advisory and vulnerability history checks can reuse matching results across platforms when a formula’s declarations are platform-independent, reducing repeated formula loading and advisory queries.
  • Platform-specific formulae continue to be checked separately, and results are not reused when relevant evidence or advisory aliases change.

Walkthrough

The change adds source analysis for platform-independent formulae and uses its results to reuse historical formula loads and reconciliation observations across simulated platforms. Advisory matching enables this reuse for new-record history processing. Tests cover source classification, platform-specific history, and observation reuse.

Changes

Platform-aware history reuse

Layer / File(s)	Summary
Classify platform-independent formula source Library/Homebrew/vulns/platform_independence.rb, Library/Homebrew/test/vulns/platform_independence_spec.rb	The new validator checks formula source with Prism and accepts supported literal declarations. Specs cover accepted and rejected source patterns, including unreadable and unparsable source.
Reuse qualifying historical formula loads Library/Homebrew/vulns/history.rb, Library/Homebrew/formula_versions.rb, Library/Homebrew/test/vulns/history_spec.rb	History reuses formula objects across platforms only when revision source passes the platform-independence check. FormulaVersions#formula_at_revision can load supplied source. Specs compare reuse with full loads and cover platform-specific removed resources.
Reuse reconciliation observations Library/Homebrew/vulns/match.rb, Library/Homebrew/test/vulns/match_spec.rb	Match#reconcile_history can reuse observations for platform-independent formula objects, keyed by formula identity and hit evidence. Specs cover changes to upstream constraints and advisory aliases.
Enable reuse in advisory matching Library/Homebrew/dev-cmd/advisory-match.rb, Library/Homebrew/test/dev-cmd/advisory-match_spec.rb, docs/Advisory-Matching.md	New-record history enables platform reuse. For an independent current formula, later platform passes reuse its formula and hits. Specs cover query reuse, fallback behavior, and early stopping. The documentation describes the reuse conditions.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Refactor

Sequence Diagram(s)

sequenceDiagram
  participant AdvisoryMatch
  participant PlatformIndependence
  participant Match
  participant History
  participant FormulaVersions
  AdvisoryMatch->>PlatformIndependence: Check current formula source
  AdvisoryMatch->>Match: reconcile_history(reuse_platforms: true)
  Match->>History: walk(reuse_platforms: true)
  History->>PlatformIndependence: Check historical revision source
  alt Source is platform-independent
    History->>FormulaVersions: Load formula with supplied source
    History-->>Match: Return shared formula marked independent
    Match->>Match: Reuse observation for formula identity and hit evidence
  else Source is platform-dependent
    History-->>Match: Load formula for simulated platform
  end

Loading

---

Merge Risk | ⚪ Minimal · up to 613ae

Merge Risk: ⚪ Minimal · up to 613ae

No actionable issue is established for this change. It is mergeable subject to normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 613ae

The optimization can reuse historical data without proving that the actual loaded formula is platform-independent. When historical formula paths overlap, this can narrow generated vulnerability ranges incorrectly. Existing reviewed-record reconciliation remains outside the optimized path.

Retained concerns

• Medium · security · inferred: An independence proof can attach to the wrong historical Formula object. FormulaVersions visits current and legacy paths but returns a revision-cached object without checking the requested entry or supplied source. History then marks that returned object independent based on the requested entry's source. When both paths exist at a revision and their metadata differs, platform-dependent metadata can enter shared history and observation caches, potentially producing an unsupported early fixed boundary in generated advisories.

Security review details

Security Blast Radius

• inferred — The identified exposure is generated advisory-range integrity for formulas with overlapping current and legacy historical paths. Deliberate exploitation requires control over tap history accepted by the loader and invocation of new-record generation. The inspected change does not establish additional credential, tenant, service or infrastructure authority; existing-record reconciliation does not enable the optimization.

Security Findings and Attack Paths

• inferred — A static counterexample is a revision appearing under both paths: the current-path formula loads version 2, fixed, on macOS and version 1, affected, on Linux, while the legacy entry contains literal metadata. Classifying the legacy entry can mark the already-loaded macOS object reusable. A later Linux walk then observes its actual affected version 1 plus a transferred fixed version 2. With a later genuine fixed version 3, this can close the Linux interval at 2 rather than 3; platform union cannot restore the omitted interval when macOS was never affected. Valid-looking reconstructed events are passed into generated records. This is an inferred execution path, not an executed reproduction.

Trust Boundaries and Controls

• observed — Unknown source retains platform-specific loading, and unavailable history, conflicting evidence or patch-review reasons prevent replacement boundaries. These controls protect ordinary single-entry histories. They do not catch a successful cache return whose loaded source differs from the source that received the independence proof.

Resilience and Maintainability Implications

• observed — Shared objects are stored after successful loading, failed loads remain retryable, and the platform loop is sequential. Shared Formula objects are nevertheless mutable and yielded to callbacks without a read-only guard; the inspected matching callbacks read them rather than changing their metadata. Callback mutation is a remaining ownership assumption, not an established PR attack path.

Hardening Proposals

• proposed — Bind independence certification to the actual loaded source identity. Preserve any intentional rename aliasing separately, and require matching entry or blob provenance before promoting an object into cross-platform shared state. An overlapping-path case with differing platform versions should demonstrate that reuse preserves the full-walk vulnerability interval.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: reusing platform-independent history during advisory matching.
Description check		The description directly explains the platform-independent history reuse, the fallback behavior, benchmark results, tests, and validation performed.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}