[MikeMcQuaid]

• Preserve an explicit --require-sha when --force is also passed, including when the environment enables the same policy.
• Allow --force to override an environment-only checksum requirement during install, reinstall and upgrade.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

Summary by CodeRabbit

• Bug Fixes
  • Cask checksum requirements are enforced during installation, reinstallation and upgrades. Using --force no longer bypasses an explicitly requested --require-sha.
  • When the checksum requirement comes only from the environment, --force can override it.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 65641c87-be29-4672-a7ae-7ff059406a16

📥 Commits

Reviewing files that changed from the base of the PR and between a6c6664 and 12f02ec.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cc6b5996-3f84-453a-a343-f8ea2293f3b2

📥 Commits

Reviewing files that changed from the base of the PR and between e34113b and a6c6664.

📒 Files selected for processing: 8

• Library/Homebrew/cask/installer.rb
• Library/Homebrew/cli/args.rb
• Library/Homebrew/cli/parser.rb
• Library/Homebrew/cmd/install.rb
• Library/Homebrew/cmd/reinstall.rb
• Library/Homebrew/cmd/upgrade.rb
• Library/Homebrew/test/cask/installer_spec.rb
• Library/Homebrew/test/cli/parser_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Cask checksum requirements now account for whether require_sha came from the environment or an explicit command-line option. Cask install, reinstall, and upgrade paths pass this policy to the downloader, which honours the requirement when force is enabled.

Changes: Cask checksum policy

Layer / File(s)	Summary
Track checksum option sources Library/Homebrew/cli/args.rb, Library/Homebrew/cli/parser.rb, Library/Homebrew/test/cli/parser_spec.rb	The parser records environment-sourced switches. Args stores them and provides a cask-specific checksum requirement predicate. Parser tests cover default, environment-sourced and explicit checksum requirements with force.
Apply checksum policy to cask operations Library/Homebrew/cmd/install.rb, Library/Homebrew/cmd/reinstall.rb, Library/Homebrew/cmd/upgrade.rb, Library/Homebrew/cask/installer.rb, Library/Homebrew/test/cask/installer_spec.rb	Cask install, reinstall, and upgrade paths pass the cask-specific requirement to installers. Both downloader paths honour the requirement. The installer test checks that --require-sha with --force rejects a cask with sha256 :no_check.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to a6c66

No actionable checksum-policy issue remains identified; this change is mergeable after normal checks.

Security architecture risk: ⚪ Minimal · up to a6c66

Explicit checksum requirements remain enforced when --force is supplied. The existing override for environment-only requirements is preserved. The reviewed execution and recovery paths show no material security risk introduced by this change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed control governs downloaded cask artifacts selected by a local install, reinstall or upgrade invocation. Its downstream security significance is whether those artifacts may proceed to installation without a declared checksum; it does not grant a new caller identity or installation privilege.

Security Findings and Attack Paths

• inferred — For the inspected paths, an untrusted download cannot use --force to defeat an explicitly requested checksum requirement: explicit provenance survives environment defaults, both downloader choices receive the requirement, and missing-checksum rejection occurs before installation. No introduced attack path was identified in this chain.

Trust Boundaries and Controls

• observed — Environment-only checksum requirements remain user-overridable defaults, not an administrator-enforced boundary. Allowing --force to override them preserves the base behavior; the security improvement is retaining an explicit requirement rather than removing this existing exemption.

Resilience and Maintainability Implications

• observed — Cached reuse requires checksum validation; missing-checksum downloads proceed through fetch-time policy enforcement. Queue staging follows successful validation, checksum failures remove bad cached artifacts, retries re-enter fetch, and cancellation or extraction failure retains cleanup controls. These existing mechanisms preserve the verification boundary across repetition and partial failure.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preserving explicit cask checksum requirements when --force is used.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}