What is the review process for adding a cask

[joekir]

What's the review process when someone wants to add a new cask?

Additionally are there any continuous checks against the urls included in the cask definitions?

[SMillerDev]

The required steps are here, https://github.com/Homebrew/homebrew-cask/blob/master/doc/development/adding_a_cask.md

And the CI run will check a bunch of common issues when you submit a PR.

[joekir]

I read the linked doc, and FAQs.

So nothing explicitly to prevent malicious binaries being added to the upstream url field either 1) upon initial PR or 2) at some point in future?

[SMillerDev]

There's people who run a virus scanner on brew casks ocasionally, but for an actor to add malicious binaries they'd need to compromise upstream since the maintainers check if the URL is from the actual upstream.