Require verifiable official formula sources

[MikeMcQuaid]

• Reject unchecked archives, resources and external patches, including cached downloads, unless installing without the API.
• Audit patches, versioned HEAD resources and full stable Git revisions across all taps; reject unverifiable stable sources in official taps.
• Stage third-party checksum and stable VCS strategy deprecations for the next major release while preserving moving HEAD sources.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

Summary by CodeRabbit

• Bug Fixes
  • Cached downloads and external patches are now checked for integrity when reused, including when no checksum is recorded.
  • Missing checksums on resources from official taps are reported or rejected, with warning behaviour retained in applicable cases.
• New Features
  • Formula audits now check checksums for patches and versioned resources, and require full Git revision hashes for stable downloads.
  • Audits distinguish checksum requirements for official and unofficial taps.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 850888a7-743b-413e-93fe-90548f75e843

📥 Commits

Reviewing files that changed from the base of the PR and between 41d4cc7 and 85ffa72.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 510a3c77-4837-4618-81bc-d465667cccb5

📥 Commits

Reviewing files that changed from the base of the PR and between 1d99f44 and 34ecf24.

📒 Files selected for processing: 6

• Library/Homebrew/external_patch.rb
• Library/Homebrew/formula_auditor.rb
• Library/Homebrew/resource.rb
• Library/Homebrew/resource_auditor.rb
• Library/Homebrew/test/formula_auditor_spec.rb
• Library/Homebrew/test/resource_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The change updates resource checksum and Git revision audits, adds checksum audits for formula and resource patches, and verifies cached downloads when no checksum is declared. Tests cover official-tap, third-party, API-install, and head-resource cases.

Changes: Resource integrity and auditing

Layer / File(s)	Summary
Audit checksum and revision requirements Library/Homebrew/resource_auditor.rb, Library/Homebrew/formula_auditor.rb, Library/Homebrew/download_strategy/vcs_download_strategy.rb, Library/Homebrew/test/formula_auditor_spec.rb	Resource audits check Git revision lengths and checksum requirements. Formula audits pass exclusion options to resource audits and check patch checksums. Tests cover stable VCS sources, missing checksums, and short Git revisions. The VCS file adds a commented deprecation proposal.
Verify cached downloads Library/Homebrew/resource.rb, Library/Homebrew/external_patch.rb, Library/Homebrew/test/resource_spec.rb	Resource staging and external patch application verify cached downloads even when no checksum is declared. Tests cover missing checksums, mismatches, API-install settings, third-party formulae, and moving HEAD archives.

Priority: ➖ Normal

Unblocks: 1 PR

Merge Risk: ⚪ Minimal · up to 34ecf

The previously identified audit and HEAD-installation failures are addressed at this head. No actionable merge-blocking risk remains after normal checks.

Security architecture risk: 🔵 Low · up to 34ecf

The change strengthens verification before source extraction and patch application. No newly weakened trust boundary was identified. Existing exceptions and limits of Git revision validation remain, and concurrency coverage is incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected trust boundary is downloaded or cached source content entering formula extraction and patch application, including nested resources. An upstream or cache-content attacker previously benefiting from an absent checksum now encounters rejection on eligible official-formula file paths; moving HEAD, third-party and explicit development exceptions limit that protection.

Security Findings and Attack Paths

• inferred — A pre-existing limitation remains for Git metadata: branch takes precedence over revision, branch updates reset to the remote branch, and the runtime revision comparison is tag-only. Consequently, a stable Git source with branch plus a full revision can pass the new hash-format audit while still following the branch. This PR leaves that consumer behavior and exposure unchanged; it is not retained as an introduced architecture concern.

Trust Boundaries and Controls

• observed — The official missing-checksum error is raised in Resource before delegation, so the superclass rescue that normally warns about absent checksums cannot swallow it. The moving-HEAD and development exceptions do not bypass declared-checksum verification on this Resource path.

Resilience and Maintainability Implications

• observed — Fresh fetches invoke verification before returning their download. Cached unstaged resources verify before unpacking, and cached patches verify before extraction and application. These paths preserve failure containment rather than allowing a failed integrity check to proceed into source use.

Hardening Proposals

• proposed — For a future end-to-end immutable Git-source policy, reject conflicting branch metadata for stable sources or verify the resolved commit against the declared revision for every supported reference type. This would address the pre-existing distinction between accepting revision metadata and actually pinning the checkout.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: requiring verifiable sources for official formulae.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ae235a6e-aa74-47b4-a027-c141dffbbb33

📥 Commits

Reviewing files that changed from the base of the PR and between 205727f and 91954fd.

📒 Files selected for processing: 7

• Library/Homebrew/download_strategy/vcs_download_strategy.rb
• Library/Homebrew/external_patch.rb
• Library/Homebrew/formula_auditor.rb
• Library/Homebrew/resource.rb
• Library/Homebrew/resource_auditor.rb
• Library/Homebrew/test/formula_auditor_spec.rb
• Library/Homebrew/test/resource_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.