Skip to content

audit: don't allow both sha256 and tag/revision for formula #8470

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 26, 2020

Conversation

dtrodrigues
Copy link
Member

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same change?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you written new tests for your changes? Here's an example.
  • Have you successfully run brew style with your changes locally?
  • Have you successfully run brew tests with your changes locally?

There are a few cases where formulae started using a source archive with a sha checksum and later moved to a git checkout with a tag/revision. In the best case case, the sha is no longer irrelevant to the git repository and in general it is out of date. This style check will detect and flag cases where a formula both has a sha256 as well as a tag and revision in the url.

CI is expected to fail until changes to the formulae below are incorporated.

$ brew style homebrew/core
== aws-iam-authenticator.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== krew.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== ksync.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== kubeseal.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== mage.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== shogun.rb ==
C:  7:  3: Do not use both sha and tag/revision.
== solarus.rb ==
C:  7:  3: Do not use both sha and tag/revision.

5200 files inspected, 7 offenses detected

Sorry, something went wrong.

Copy link
Member

@MikeMcQuaid MikeMcQuaid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One tweak but good to ship then (when CI is green). Good catch!

Verified

This commit was signed with the committer’s verified signature.
issyl0 Issy Long
@dtrodrigues dtrodrigues changed the title audit: don't allow both sha and tag/revison for formula audit: don't allow both sha256 and tag/revision for formula Aug 26, 2020
@dtrodrigues dtrodrigues merged commit 04382c8 into Homebrew:master Aug 26, 2020
@BrewTestBot BrewTestBot added the outdated PR was locked due to age label Dec 15, 2020
@Homebrew Homebrew locked as resolved and limited conversation to collaborators Dec 15, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
outdated PR was locked due to age
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants