gnu-getopt cannot be used as dependency

[LecrisUT]

See new formula attempt: #164352

What were you trying to do (and why)?

Add a gnu-getopt dependency for MacOS since it seems that it still does not have an enhanced version

What happened (include all command output)?

I have tried with:

  on_macos do
    depends_on "gnu-getopt"
  end

but that results in:

* Dependency 'gnu-getopt' is provided by macOS; please replace 'depends_on' with 'uses_from_macos'.

Trying the suggested approach was not successful either because:

uses_from_macos "gnu-getopt", since: :sonoma

uses the MacOS version of getopt when on sonoma which still is not compatible.

What did you expect to happen?

Have a way to include gnu-getopt dependency

Other references

• xorg-server 21.1.6 (new formulae) #109215 (comment)

[SMillerDev]

It is something that maintainers should be warned about, so that's why the audit is failing.

[LecrisUT]

Sure, that would be good for the review, but then how can we add new formulas that need this dependency since it fails the CI? You've mentioned there could be a whitelist for that, but the only reference I could find is in uses_from_macos. All other implementations seem to be before uses_from_macos check got implemented

[Bo98]

https://github.com/Homebrew/homebrew-core/blob/master/audit_exceptions/provided_by_macos_depends_on_allowlist.json

[LecrisUT]

Thanks for the tip, I've tried to add it there. Worth noting that this seems to only affect brew audit --online --new? I was looking at vcs for equivalent and it's not on the list, but the CI did not seem to be affected by it.

[Bo98]

It's a new formula only audit yeah. This particular allowlist is sort of useless after the initial merge - we should probably replace it with a PR label or something. Or alternatively expand the audit to apply to everything rather than just --new

[LecrisUT]

Btw, still no luck: https://github.com/Homebrew/homebrew-core/actions/runs/8234501520/job/22516507190

Would be good to expand this to all, but for the case of gnu-getopt, I think it should be removed from the uses_from_macos since no MacOS version seem to support extended getopt which is the main usecase for this formula. That or have a :newer_than_sonoma targets or equivalents.

[Bo98]

Ah right, sorry I misread what that allowlist was for - it's for the reverse situation where OpenSSL might get detected as being provided by macOS when it isn't.

In this case, we can override new formula audits - they're intentionally new formula only audits because we know they're not 100% accurate in all cases (they're there to catch cases where people list every system dependency regardless if they use extended features or not). You can revert that change and leave a note on the PR and we can merge it anyway if we see that audit is the only bit failing.

[LecrisUT]

Hmm, if that's the case, wouldn't it be worth it to cherry-pick and keep that exception until MacOS provides an extended getopt version? 275ad8a in the #164352 PR

Edit: So far that seems to have done the trick

[Bo98]

until MacOS provides an extended getopt version

macOS is a BSD-like operating system so it's unlikely it will ever ship GNU-only features. There's a lot of things in the command-line world that are BSD-only or GNU-only and some software only support one or the other.

[LecrisUT]

Welp, even more relevant than to keep the audit exception for gnu-getopt long-term than