bundle: protect alternate formula names

[AbdelrahmanHafez]

re #21350, #21351 and #24222

Receipt protection compares Brewfile entries with installed rack names. Aliases, old names and qualified names can therefore skip protection.

This resolves each entry before selecting its receipt. It keeps the direct write and permission fallback from #21410.

The new unit tests cover each name form.

Reproduce on a disposable Homebrew installation:

brew install kubernetes-cli jq
brew tab --no-installed-on-request kubernetes-cli
printf 'brew "kubectl"\n' > /tmp/names-Brewfile
brew bundle cleanup --force --formula --file=/tmp/names-Brewfile
brew list kubernetes-cli

Before this change, cleanup removes kubernetes-cli despite its Brewfile entry. With this change, kubernetes-cli remains installed.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Astra 6 High generated the solution and the tests. Opus 5.5 High reviewed them independently. Tests reproduced the failure before the fix and passed afterward. I reviewed everything in this PR and believe I have good understanding for the problem and the solution. Will do my best answering without AI. :)

---

[coderabbitai]

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Brew Bundle now recognizes formulas by canonical name, alias, renamed name, or fully qualified core and tap names when recording installation requests.
  • Brewfile formula names using homebrew/core and homebrew/homebrew-core are now handled consistently during sanitization and cleanup.

📝 Summary

📝 Summary

📝 Summary

Walkthrough

Brewfile formula names are canonicalized before installed receipts are updated. Core-qualified formula names are now recognized during sanitization, with tests covering cleanup selection and receipt marking.

Changes

Brewfile formula name handling

Layer / File(s)	Summary
Recognize core-qualified formula names Library/Homebrew/bundle/dsl.rb, Library/Homebrew/test/bundle/dsl_spec.rb, Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb	The formula-name regex accepts homebrew/homebrew, homebrew/core, and homebrew/homebrew-core, case-insensitively. Tests check sanitization of homebrew/core/foo and confirm cleanup selects only unwanted when either fully qualified core spelling of deno is in the Brewfile.
Canonicalize names for installed receipts Library/Homebrew/bundle.rb, Library/Homebrew/test/bundle/bundle_spec.rb	mark_as_installed_on_request! canonicalizes each Brewfile entry name before checking installed formulas. Tests cover canonical, alias, renamed, core-qualified, and test-tap-qualified names.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: mikemcquaid

---

Merge Risk: 🟡 Moderate · up to 86daa

The new tests fail their file-leak check. Remove the remaining core-tap formula fixture before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7d7cf

The change corrects package identity handling while retaining existing installation checks and permission behavior. No new security issue was established. Remaining uncertainty concerns restricted-permission environments and concurrent receipt updates, rather than a demonstrated boundary bypass.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated changed exposure is removal protection for installed formulas in the current Homebrew installation. Canonicalization broadens accepted spellings, but mutation remains restricted to installed rack identities and existing receipts.

Trust Boundaries and Controls

• observed — The existing EACCES fallback invokes brew tab with canonical installed names as separate process arguments. The tab command checks installation status before updating receipts. The PR preserves this authority transition; external wrapper escalation policy is not established by the inspected source.

Resilience and Maintainability Implications

• inferred — Interruption or fallback failure can leave a subset of receipts protected. This predates canonicalization and is not established as a newly introduced security weakness. Concurrent-update safety and recovery under permission-restricted metadata access remain incompletely verified.

---

Pre-merge checks · 4

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description clearly explains the receipt-protection bug, the implemented fix, reproduction steps, and test coverage. It directly matches the changeset.
Title check		The title concisely describes the main change: protecting alternate formula names during bundle operations.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[MikeMcQuaid]

Thanks! One question.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f5e33379-3df3-4158-92cd-11a971abea24

📥 Commits

Reviewing files that changed from the base of the PR and between ea07035 and 7d7cfab.

📒 Files selected for processing (5)

• Library/Homebrew/bundle.rb
• Library/Homebrew/bundle/dsl.rb
• Library/Homebrew/test/bundle/bundle_spec.rb
• Library/Homebrew/test/bundle/dsl_spec.rb
• Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Review details

🧰 Additional context used

📚 Code guidelines (1)

Generated by CodeRabbit — auto-discovered

📓 Path-based instructions (1)

Test command behavior and its observable effects, including stdout, stderr, exit status, and state changes as relevant.

📄 CodeRabbit inference engine (Generated by CodeRabbit)

Files:

• Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb

🔇 Additional comments (3)

Library/Homebrew/bundle/dsl.rb (1)

116-116: LGTM!

Library/Homebrew/test/bundle/dsl_spec.rb (1)

193-193: LGTM!

Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb (1)

140-140: LGTM!

Also applies to: 200-220

[MikeMcQuaid]

Thanks!