@@ -140,25 +140,6 @@ <h2>
140
140
</ dt >
141
141
< dd > < pre class ="code "> < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> Homebrew/homebrew-core</ span > < span class ='tstring_end '> "</ span > </ span > </ pre > </ dd >
142
142
143
- < dt id ="HOMEBREW_CORE_CI_URI-constant " class =""> HOMEBREW_CORE_CI_URI =
144
- < div class ="docstring ">
145
- < div class ="discussion ">
146
- < p class ="note private ">
147
- < strong > This constant is part of a private API.</ strong >
148
- This constant may only be used in the < a href ="https://github.com/Homebrew/brew "> Homebrew/brew</ a > repository.
149
- Third parties should avoid using this constant if possible, as it may be removed or changed without warning.
150
- </ p >
151
-
152
-
153
- </ div >
154
- </ div >
155
- < div class ="tags ">
156
-
157
-
158
- </ div >
159
- </ dt >
160
- < dd > < pre class ="code "> < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> https://github.com/Homebrew/homebrew-core/.github/workflows/publish-commit-bottles.yml@refs/heads/master</ span > < span class ='tstring_end '> "</ span > </ span > </ pre > </ dd >
161
-
162
143
< dt id ="BACKFILL_REPO-constant " class =""> BACKFILL_REPO =
163
144
< div class ="docstring ">
164
145
< div class ="discussion ">
@@ -444,6 +425,8 @@ <h3 class="signature first" id="check_attestation-class_method">
444
425
< pre class ="lines ">
445
426
446
427
428
+ 74
429
+ 75
447
430
76
448
431
77
449
432
78
@@ -481,12 +464,10 @@ <h3 class="signature first" id="check_attestation-class_method">
481
464
110
482
465
111
483
466
112
484
- 113
485
- 114
486
- 115</ pre >
467
+ 113</ pre >
487
468
</ td >
488
469
< td >
489
- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 76 </ span >
470
+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 74 </ span >
490
471
491
472
< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='lparen '> (</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_repo '> signing_repo</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_workflow '> signing_workflow</ span > < span class ='op '> =</ span > < span class ='kw '> nil</ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_subject '> subject</ span > < span class ='op '> =</ span > < span class ='kw '> nil</ span > < span class ='rparen '> )</ span >
492
473
< span class ='id identifier rubyid_cmd '> cmd</ span > < span class ='op '> =</ span > < span class ='lbracket '> [</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> attestation</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> verify</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_cached_download '> cached_download</ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> --repo</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span > < span class ='id identifier rubyid_signing_repo '> signing_repo</ span > < span class ='comma '> ,</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> --format</ span > < span class ='tstring_end '> "</ span > </ span > < span class ='comma '> ,</ span >
@@ -628,6 +609,8 @@ <h3 class="signature " id="check_core_attestation-class_method">
628
609
< pre class ="lines ">
629
610
630
611
612
+ 126
613
+ 127
631
614
128
632
615
129
633
616
130
@@ -663,14 +646,34 @@ <h3 class="signature " id="check_core_attestation-class_method">
663
646
160
664
647
161
665
648
162
666
- 163</ pre >
649
+ 163
650
+ 164
651
+ 165
652
+ 166
653
+ 167
654
+ 168
655
+ 169
656
+ 170
657
+ 171
658
+ 172</ pre >
667
659
</ td >
668
660
< td >
669
- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 128 </ span >
661
+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 126 </ span >
670
662
671
663
< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_check_core_attestation '> check_core_attestation</ span > < span class ='lparen '> (</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='rparen '> )</ span >
672
664
< span class ='kw '> begin</ span >
673
- < span class ='id identifier rubyid_attestation '> attestation</ span > < span class ='op '> =</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_REPO-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_REPO (constant) "> HOMEBREW_CORE_REPO</ a > </ span > </ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_CI_URI-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_CI_URI (constant) "> HOMEBREW_CORE_CI_URI</ a > </ span > </ span >
665
+ < span class ='comment '> # Ideally, we would also constrain the signing workflow here, but homebrew-core
666
+ </ span > < span class ='comment '> # currently uses multiple signing workflows to produce bottles
667
+ </ span > < span class ='comment '> # (e.g. `dispatch-build-bottle.yml`, `dispatch-rebottle.yml`, etc.).
668
+ </ span > < span class ='comment '> #
669
+ </ span > < span class ='comment '> # We could check each of these (1) explicitly (slow), (2) by generating a pattern
670
+ </ span > < span class ='comment '> # to pass into `--cert-identity-regex` (requires us to build up a Go-style regex),
671
+ </ span > < span class ='comment '> # or (3) by checking the resulting JSON for the expected signing workflow.
672
+ </ span > < span class ='comment '> #
673
+ </ span > < span class ='comment '> # Long term, we should probably either do (3) *or* switch to a single reusable
674
+ </ span > < span class ='comment '> # workflow, which would then be our sole identity. However, GitHub's
675
+ </ span > < span class ='comment '> # attestations currently do not include reusable workflow state by default.
676
+ </ span > < span class ='id identifier rubyid_attestation '> attestation</ span > < span class ='op '> =</ span > < span class ='id identifier rubyid_check_attestation '> check_attestation</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='comma '> ,</ span > < span class ='const '> < span class ='object_link '> < a href ="#HOMEBREW_CORE_REPO-constant " title ="Homebrew::Attestation::HOMEBREW_CORE_REPO (constant) "> HOMEBREW_CORE_REPO</ a > </ span > </ span >
674
677
< span class ='kw '> return</ span > < span class ='id identifier rubyid_attestation '> attestation</ span >
675
678
< span class ='kw '> rescue</ span > < span class ='const '> < span class ='object_link '> < a href ="Attestation/InvalidAttestationError.html " title ="Homebrew::Attestation::InvalidAttestationError (class) "> InvalidAttestationError</ a > </ span > </ span >
676
679
< span class ='id identifier rubyid_odebug '> odebug</ span > < span class ='tstring '> < span class ='tstring_beg '> "</ span > < span class ='tstring_content '> falling back on backfilled attestation for </ span > < span class ='embexpr_beg '> #{</ span > < span class ='id identifier rubyid_bottle '> bottle</ span > < span class ='embexpr_end '> }</ span > < span class ='tstring_end '> "</ span > </ span >
@@ -752,17 +755,17 @@ <h3 class="signature " id="gh_executable-class_method">
752
755
< pre class ="lines ">
753
756
754
757
758
+ 47
759
+ 48
755
760
49
756
761
50
757
762
51
758
763
52
759
764
53
760
- 54
761
- 55
762
- 56</ pre >
765
+ 54</ pre >
763
766
</ td >
764
767
< td >
765
- < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 49 </ span >
768
+ < pre class ="code "> < span class ="info file "> # File 'attestation.rb', line 47 </ span >
766
769
767
770
< span class ='kw '> def</ span > < span class ='kw '> self</ span > < span class ='period '> .</ span > < span class ='id identifier rubyid_gh_executable '> gh_executable</ span >
768
771
< span class ='comment '> # NOTE: We disable HOMEBREW_VERIFY_ATTESTATIONS when installing `gh` itself,
0 commit comments