cask/audit: check signing of more artifact types

[bevanjkay]

• audit_signing only saw app, pkg, binary and manual installers, so suites, plugins, prefpanes, screen savers and other bundles were never Gatekeeper checked.
• Scan bundle artifacts with gktool scan, as for app.
• Walk suite and generic artifact folders, scanning each bundle and checking loose Mach-O executables for notarisation; gktool rejects any plain folder so the folder itself is not scanned.
• Check Mach-O installer script: executables for notarisation.
• Select these through a new opt-in include_signable: so the other extract_artifacts audits are unchanged and font casks still skip the download.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude with Opus 5.5 at High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf7aeb99-1a9f-477e-bb67-185065306550

---

📥 Commits

Reviewing files that changed from the base of the PR and between 6c0c05c and 3c37303.

---

📒 Files selected for processing (2)

• Library/Homebrew/cask/audit.rb
• Library/Homebrew/test/cask/audit_spec.rb

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: docker (arm64 Ubuntu 26.04)
• GitHub Check: docker (x86_64 Ubuntu 26.04)
• GitHub Check: docker (x86_64 Ubuntu 24.04)
• GitHub Check: docker (arm64 Ubuntu 24.04)
• GitHub Check: tests (online, 1/2)
• GitHub Check: tests (Linux, 1/2)
• GitHub Check: tests (no Sorbet)
• GitHub Check: tests (online, 2/2)
• GitHub Check: tests (generic OS, 1/2)
• GitHub Check: tests (load-only Linux)
• GitHub Check: tests (macOS, 2/2)
• GitHub Check: tests (generic OS, 2/2)
• GitHub Check: tests (load-only macOS)
• GitHub Check: tests (Linux, 2/2)
• GitHub Check: tests (macOS, 1/2)
• GitHub Check: syntax
• GitHub Check: workflow_syntax
• GitHub Check: docs
• GitHub Check: Analyze

---

🔇 Additional comments (2)

Library/Homebrew/cask/audit.rb (1)

33-37: LGTM!

Also applies to: 177-178, 185-185, 196-199, 634-634, 660-660, 663-663, 665-667, 675-696, 702-702, 707-707, 1248-1267

---

Library/Homebrew/test/cask/audit_spec.rb (1)

814-832: LGTM!

Also applies to: 834-835, 840-842, 846-851, 946-1040

---

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Cask signing audits now check a wider range of signable items, including apps and executables within suites, installer scripts, and supported bundle types, helping identify Gatekeeper and notarization issues.
  • Casks containing only fonts or Quick Look plugins no longer trigger unnecessary downloads or unpacking during signing audits. If Gatekeeper scanning is unavailable, the audit displays a warning and skips those bundle scans.

Walkthrough

Cask signing audits now select installers, suites, generic artifacts, and listed Gatekeeper bundle artifact types. The audit checks bundles and executable files through assessment helpers and reports failed checks.

Changes

Signable Artifact Auditing

Layer / File(s)	Summary
Select artifacts for signing audits Library/Homebrew/cask/audit.rb, Library/Homebrew/test/cask/audit_spec.rb	extract_artifacts can include all signable artifact types, and audit_signing enables this option. Tests cover font, Quick Look plugin, and suite-only casks.
Assess selected artifacts Library/Homebrew/cask/audit.rb, Library/Homebrew/test/cask/audit_spec.rb	The audit checks selected bundles, executables, packages, and installer scripts with assessment helpers. Tests cover failed checks and suites without code.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CaskAudit
  participant gatekeeper_scan
  participant gktool
  participant spctl
  participant codesign
  CaskAudit->>gatekeeper_scan: Scan selected bundle artifacts
  gatekeeper_scan->>gktool: Scan when available
  CaskAudit->>spctl: Assess package artifacts
  CaskAudit->>codesign: Check notarization

Loading

Suggested reviewers: mikemcquaid

---

Merge Risk | ⚪ Minimal · up to 3c373

Merge Risk: ⚪ Minimal · up to 3c373

This change extends cask signing audits to more artifact types. No concrete risk was identified in the supplied context, so it appears mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3c373

The change strengthens signing checks without executing downloaded installers or increasing the checking commands’ privileges. Risk is low, but coverage still depends on platform support and available signing tools; hostile-path behavior has not been validated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The added exposure is local processing of more downloaded payloads and nested files during an eligible audit. Assessment commands retain the invoking process’s authority rather than requesting elevation. The inspected assessment path does not execute discovered installer scripts.

Trust Boundaries and Controls

• observed — Payload paths are passed as separate arguments to fixed assessment commands, not interpolated into shell command strings. SystemCommand defaults to sudo: false. Broader selection does not remove these invocation controls.
• observed — Relocated source construction joins cask-supplied strings to staged_path without a canonical containment check. Audit path reconstruction uses the same pre-existing mapping. This is not evidence of a newly introduced escape, but joining paths alone does not establish confinement of the new recursive inspection.

Resilience and Maintainability Implications

• observed — New tests assert failed-check propagation for additional bundles, nested apps, loose executables and installer executables, plus no assessment for a non-code suite. Their extraction, quarantine and command results are mocked, so they do not establish real platform-tool behavior or interruption recovery.

Hardening Proposals

• proposed — Consider explicitly enforcing canonical containment within the audit extraction directory before recursive inspection, with traversal and symlink cases. This would strengthen an existing path assumption, not remediate a verified PR-introduced vulnerability.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check		The description directly explains the changes to signing audits, including additional artifact types, Gatekeeper scanning, notarization checks, and test coverage.
Title check		The title clearly and concisely identifies the main change: expanding signing checks to more Cask artifact types.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[MikeMcQuaid]

Thanks!