[MikeMcQuaid]

• Require signed metadata digests for fresh and cached patch files, including resource patches, before using them in source builds.
• Deploy after the API publishes local patch checksums; old metadata requires an update rather than silently trusting raw file downloads.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

Summary by CodeRabbit

• Bug Fixes
  • Formula and resource patches can be installed using checksum information from local metadata.
  • Patch contents that do not match their checksums are rejected, whether downloaded or cached.
  • If checksum information is missing, installation reports an error and advises refreshing API metadata.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c285c015-7be1-43d8-bcac-d1d23b3c2645

📥 Commits

Reviewing files that changed from the base of the PR and between 37f7db5 and 9d1f468.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5b3d824-5477-4850-a3be-261e4c0beaf8

📥 Commits

Reviewing files that changed from the base of the PR and between 4612467 and 37f7db5.

📒 Files selected for processing: 1

• Library/Homebrew/test/api/formula_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Formula source downloads now use local patch checksums when no checksum is supplied and raise an error when no checksum is available. Tests cover formula and resource patches, checksum mismatches, and missing checksum metadata.

Changes: Formula source checksum handling

Layer / File(s)	Summary
Checksum resolution and patch validation Library/Homebrew/api/formula.rb, Library/Homebrew/test/api/formula_spec.rb	source_download_path uses a local patch checksum when its checksum argument is absent and raises CannotInstallFormulaError if no checksum is available. An existing symlink no longer triggers the former checksum verification branch. Tests cover formula and resource patch loading, checksum mismatches, and missing API checksum metadata.

Priority: ➖ Normal

Unblocks: 2 PRs

Merge Risk: ⚪ Minimal · up to 37f7d

Cached patch downloads remain checksum-verified, and the new checksum requirement does not block ordinary source archives. No merge-blocking issue was found.

### Architecture Summary

Architecture risk: 🔵 Low · up to 37f7d

The change affects 1 system.

Changed systems: Library

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Library (api) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in Library/Homebrew/api/formula.rb: source_download_path now falls back to the formula’s local-patch checksum when its checksum argument is nil, and raises CannotInstallFormulaError if the resulting checksum is blank.
• observed — Modified behavior in Library/Homebrew/api/formula.rb: When the symlink location already exists as a symlink, the code now takes an empty else branch instead of verifying the cached download’s integrity when a checksum is present.
• observed — Modified behavior in Library/Homebrew/test/api/formula_spec.rb: The source-download fixture now supplies a SHA-256 checksum for the formula source instead of nil.
• observed — Modified behavior in Library/Homebrew/test/api/formula_spec.rb: The source-download-formula fixture now supplies a SHA-256 checksum for the formula source instead of nil.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarises the main change: verification of API formula patch downloads.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}