diff --git a/docs/skills/brew-lifecycle/SKILL.md b/docs/skills/brew-lifecycle/SKILL.md index 012780fb..c4392d8d 100644 --- a/docs/skills/brew-lifecycle/SKILL.md +++ b/docs/skills/brew-lifecycle/SKILL.md @@ -82,7 +82,7 @@ not `system_files/bluefin/preinstall.d/`. See [package-set.md](references/packag - Suggesting `rpm-ostree install` for any missing tool — this is never correct on Bluefin - Adding a package to `preinstall.d/` that has a udev rule, kernel module, D-Bus system service, FUSE driver, firmware, or PAM dependency — it must stay as an RPM -- Adding a tap without `trusted: true` / `--trust` (Homebrew 6.0 blocks untrusted taps silently) +- Adding a tap without `trusted: true` in Brewfiles or a following `brew trust` command in recipes (Homebrew 6.0 blocks untrusted taps silently) - Bumping a version number or manual stamp to "trigger" a brew-preinstall re-run — the service is content-addressed; edit the Brewfile and the hash change triggers it automatically - Editing `preinstall.d/` in a downstream repo (bluefin, bluefin-lts, dakota) for packages that should live in `common` — common ships to all variants - Assuming `brew-preinstall.service` ran successfully because it's enabled — the service exits 0 silently if brew is not yet installed; check `journalctl --user -u brew-preinstall.service` diff --git a/docs/skills/brew-lifecycle/references/placement-rules.md b/docs/skills/brew-lifecycle/references/placement-rules.md index 3179c7dc..75294aab 100644 --- a/docs/skills/brew-lifecycle/references/placement-rules.md +++ b/docs/skills/brew-lifecycle/references/placement-rules.md @@ -59,9 +59,11 @@ Antigravity, Zed, Cursor, framework_tool, asusctl-linux. **In just recipes** that call `brew tap` before cask installs: ```diff - brew tap ublue-os/tap 2>/dev/null || true -+ brew tap --trust ublue-os/tap ++ brew tap ublue-os/tap 2>/dev/null || true ++ brew trust ublue-os/tap 2>/dev/null || true ``` -The `|| true` silencer must be removed — tap failures should surface. +Keep the existing error handling for each recipe; `brew trust` is a separate +command and must run after the tap succeeds. **In Brewfiles** that declare taps (Homebrew 6.0 Brewfile-native syntax): ```ruby @@ -70,16 +72,16 @@ tap "ublue-os/experimental-tap", trusted: true ``` **Do not use `HOMEBREW_TRUSTED_TAPS` env var** — this was a Homebrew 4.x -mechanism. The correct 6.0 approach is `--trust` at tap-time and -`trusted: true` in Brewfiles. +mechanism. The correct 6.0 approach is `brew tap` followed by `brew trust`, +or `trusted: true` in Brewfiles. ### Known trust issues in the codebase (as of 2026-06) | File | Current code | Status | |---|---|---| -| `system.just` dx recipe | `brew tap --trust ublue-os/tap` | ✅ correct | -| `system.just` dx recipe | `brew tap --trust ublue-os/experimental-tap` | ✅ correct | -| `apps.just` install-jetbrains-toolbox | `brew tap ublue-os/homebrew-tap` | ❌ wrong tap name + no `--trust` | +| `system.just` dx recipe | `brew tap` + `brew trust` | ✅ correct | +| `system.just` dx recipe | `brew tap` + `brew trust` | ✅ correct | +| `apps.just` install-jetbrains-toolbox | `brew tap` + `brew trust` | ✅ correct | | `apps.just` bbrew recipe | `brew install Valkyrie00/homebrew-bbrew/bbrew` | ❌ 3rd-party tap, no trust | Ref: https://brew.sh/2026/06/11/homebrew-6.0.0/ diff --git a/docs/skills/oem-hardware-hooks/references/oem-brew.md b/docs/skills/oem-hardware-hooks/references/oem-brew.md index 6b4de879..29921dbe 100644 --- a/docs/skills/oem-hardware-hooks/references/oem-brew.md +++ b/docs/skills/oem-hardware-hooks/references/oem-brew.md @@ -124,4 +124,4 @@ the file and repeated logins safely refresh it. ## Known gaps (tracking issues) - `20-framework.sh` in `projectbluefin/bluefin` is superseded by `20-oem-brew.sh` in common — file a cleanup issue in bluefin to delete it after common ships. -- `apps.just` ASUS recipe still calls `brew install --cask` directly without `--trust`; update to use Brewfile or `--trust` flag. +- `apps.just` ASUS recipe still calls `brew install --cask` directly; update to use Brewfile or pair `brew tap` with `brew trust`. diff --git a/system_files/bluefin/usr/libexec/bazaar-hook b/system_files/bluefin/usr/libexec/bazaar-hook index 657cfe5e..91781e0e 100755 --- a/system_files/bluefin/usr/libexec/bazaar-hook +++ b/system_files/bluefin/usr/libexec/bazaar-hook @@ -31,7 +31,7 @@ def spawn_brew(app): brew = '/home/linuxbrew/.linuxbrew/bin/brew' spawn_and_detach([ 'flatpak-spawn', '--host', 'xdg-terminal-exec', '-x', - 'bash', '-c', f'{brew} tap --trust ublue-os/tap && {brew} install --cask {app}' + 'bash', '-c', f'{brew} tap ublue-os/tap && {brew} trust ublue-os/tap && {brew} install --cask {app}' ]) def handle_jetbrains(): diff --git a/system_files/bluefin/usr/share/ublue-os/just/system.just b/system_files/bluefin/usr/share/ublue-os/just/system.just index 7269ea3c..081f6155 100644 --- a/system_files/bluefin/usr/share/ublue-os/just/system.just +++ b/system_files/bluefin/usr/share/ublue-os/just/system.just @@ -146,10 +146,12 @@ toggle-devmode: # Taps are silent/fast — run before the progress bar if _dx_wants -E "VS Code|VSCodium|Antigravity|JetBrains"; then - brew tap --trust ublue-os/tap + brew tap ublue-os/tap + brew trust ublue-os/tap fi if _dx_wants "Zed"; then - brew tap --trust ublue-os/experimental-tap + brew tap ublue-os/experimental-tap + brew trust ublue-os/experimental-tap fi # Build install queue for the progress bar diff --git a/system_files/shared/usr/share/ublue-os/just/apps.just b/system_files/shared/usr/share/ublue-os/just/apps.just index 7ca0cb8e..07db46a0 100644 --- a/system_files/shared/usr/share/ublue-os/just/apps.just +++ b/system_files/shared/usr/share/ublue-os/just/apps.just @@ -9,7 +9,8 @@ jetbrains-toolbox: [group('Apps')] install-jetbrains-toolbox: #!/usr/bin/env bash - brew tap --trust ublue-os/tap + brew tap ublue-os/tap + brew trust ublue-os/tap brew install --cask ublue-os/tap/jetbrains-toolbox-linux # Install OpenTabletDriver, an open source, cross-platform, user-mode tablet driver @@ -60,7 +61,8 @@ install-asus: #!/usr/bin/env bash set -euo pipefail echo "Installing ASUS laptop tools..." - brew tap --trust ublue-os/tap + brew tap ublue-os/tap + brew trust ublue-os/tap brew install --cask ublue-os/tap/asusctl-linux brew install --cask ublue-os/tap/rog-control-center-linux echo ""