@@ -140,25 +140,6 @@ <h2>
140140 </ dt >
141141 < dd > < pre class ="code "> < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> Homebrew/homebrew-core</ span > < span class ='tstring_end '> "</ span > </ span > </ pre > </ dd >
142142
143- < dt id ="HOMEBREW_CORE_CI_URI-constant " class =""> HOMEBREW_CORE_CI_URI =
144- < div class ="docstring ">
145- < div class ="discussion ">
146- < p class ="note private ">
147- < strong > This constant is part of a private API.</ strong >
148- This constant may only be used in the < a href ="https://github.com/Homebrew/brew "> Homebrew/brew</ a > repository.
149- Third parties should avoid using this constant if possible, as it may be removed or changed without warning.
150- </ p >
151-
152-
153- </ div >
154- </ div >
155- < div class ="tags ">
156-
157-
158- </ div >
159- </ dt >
160- < dd > < pre class ="code "> < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> https://github.com/Homebrew/homebrew-core/.github/workflows/publish-commit-bottles.yml@refs/heads/master</ span > < span class ='tstring_end '> "</ span > </ span > </ pre > </ dd >
161-
162143 < dt id ="BACKFILL_REPO-constant " class =""> BACKFILL_REPO =
163144 < div class ="docstring ">
164145 < div class ="discussion ">
@@ -444,6 +425,8 @@ <h3 class="signature first" id="check_attestation-class_method">
444425 < pre class ="lines ">
445426
446427
428+ 74
429+ 75
44743076
44843177
44943278
@@ -481,12 +464,10 @@ <h3 class="signature first" id="check_attestation-class_method">
481464110
482465111
483466112
484- 113
485- 114
486- 115</ pre >
467+ 113</ pre >
487468 </ td >
488469 < td >
489- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 76 </ span >
470+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 74 </ span >
490471
491472< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='lparen '> (</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_repo '> signing_repo</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_workflow '> signing_workflow</ span > < span class ='op '> =</ span > < span class ='kw '> nil</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_subject '> subject</ span > < span class ='op '> =</ span > < span class ='kw '> nil</ span > < span class ='rparen '> )</ span >
492473 < span class ='id identifier rubyid_cmd '> cmd</ span > < span class ='op '> =</ span > < span class ='lbracket '> [</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> attestation</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> verify</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_cached_download '> cached_download</ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> --repo</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_repo '> signing_repo</ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> --format</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span >
@@ -628,6 +609,8 @@ <h3 class="signature " id="check_core_attestation-class_method">
628609 < pre class ="lines ">
629610
630611
612+ 126
613+ 127
631614128
632615129
633616130
@@ -663,14 +646,34 @@ <h3 class="signature " id="check_core_attestation-class_method">
663646160
664647161
665648162
666- 163</ pre >
649+ 163
650+ 164
651+ 165
652+ 166
653+ 167
654+ 168
655+ 169
656+ 170
657+ 171
658+ 172</ pre >
667659 </ td >
668660 < td >
669- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 128 </ span >
661+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 126 </ span >
670662
671663< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_check_core_attestation '> check_core_attestation</ span > < span class ='lparen '> (</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='rparen '> )</ span >
672664 < span class ='kw '> begin</ span >
673- < span class ='id identifier rubyid_attestation '> attestation</ span > < span class ='op '> =</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_REPO-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_REPO (constant) "> HOMEBREW_CORE_REPO</ a > </ span > </ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_CI_URI-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_CI_URI (constant) "> HOMEBREW_CORE_CI_URI</ a > </ span > </ span >
665+ < span class ='comment '> # Ideally, we would also constrain the signing workflow here, but homebrew-core
666+ </ span > < span class ='comment '> # currently uses multiple signing workflows to produce bottles
667+ </ span > < span class ='comment '> # (e.g. `dispatch-build-bottle.yml`, `dispatch-rebottle.yml`, etc.).
668+ </ span > < span class ='comment '> #
669+ </ span > < span class ='comment '> # We could check each of these (1) explicitly (slow), (2) by generating a pattern
670+ </ span > < span class ='comment '> # to pass into `--cert-identity-regex` (requires us to build up a Go-style regex),
671+ </ span > < span class ='comment '> # or (3) by checking the resulting JSON for the expected signing workflow.
672+ </ span > < span class ='comment '> #
673+ </ span > < span class ='comment '> # Long term, we should probably either do (3) *or* switch to a single reusable
674+ </ span > < span class ='comment '> # workflow, which would then be our sole identity. However, GitHub's
675+ </ span > < span class ='comment '> # attestations currently do not include reusable workflow state by default.
676+ </ span > < span class ='id identifier rubyid_attestation '> attestation</ span > < span class ='op '> =</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_REPO-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_REPO (constant) "> HOMEBREW_CORE_REPO</ a > </ span > </ span >
674677 < span class ='kw '> return</ span > < span class ='id identifier rubyid_attestation '> attestation</ span >
675678 < span class ='kw '> rescue</ span > < span class ='const '> < span class ='object_link '> < a href ="Attestation/InvalidAttestationError.html " title ="Homebrew::Attestation::InvalidAttestationError (class) "> InvalidAttestationError</ a > </ span > </ span >
676679 < span class ='id identifier rubyid_odebug '> odebug</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> falling back on backfilled attestation for </ span > < span class ='embexpr_beg '> #{</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='embexpr_end '> }</ span > < span class ='tstring_end '> "</ span > </ span >
@@ -752,17 +755,17 @@ <h3 class="signature " id="gh_executable-class_method">
752755 < pre class ="lines ">
753756
754757
758+ 47
759+ 48
75576049
75676150
75776251
75876352
75976453
760- 54
761- 55
762- 56</ pre >
765+ 54</ pre >
763766 </ td >
764767 < td >
765- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 49 </ span >
768+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 47 </ span >
766769
767770< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_gh_executable '> gh_executable</ span >
768771 < span class ='comment '> # NOTE: We disable HOMEBREW_VERIFY_ATTESTATIONS when installing `gh` itself,
0 commit comments