Repository navigation
Add Homebrew installation support - #600
thomas-chauchefoin-tob wants to merge 4 commits into
Conversation
Package coop and coop-proxy with shell completions and Lima on macOS. Building coop for Homebrew disable background update checks, and direct users to brew for upgrades and removal. This initial formula points to v0.9.1 and requires a backport of the build guards, but we can remove them once v0.9.2 shipped.
|
|
||
| on: | ||
| pull_request: | ||
| paths: |
There was a problem hiding this comment.
Could we add a CI build of this PR's source with COOP_PACKAGE_MANAGER=homebrew and assert that coop update and coop uninstall --yes --purge refuse? The formula job currently builds v0.9.1 with patch :DATA, so its passing assertions exercise that backport rather than the new Rust guards in HEAD. The Formula/** path filter also skips this job when only those guards change. Widening the path filter alone would not test HEAD's compiled behavior.
There was a problem hiding this comment.
155f30d +
3138f77 for testing coop update and coop uninstall --yes --purge.
The filter matters because the workflow is just here to make sure that changes to the formula do not break it, the Homebrew-specific build and features is already tested as part of the regular integration test suite. So it also need to apply the patch until we release v0.9.2, and remove the patch and bump the formula.
| class Coop < Formula | ||
| desc "Isolated VM environments for coding agents" | ||
| homepage "https://github.com/trailofbits/coop" | ||
| url "https://github.com/trailofbits/coop/archive/refs/tags/v0.9.1.tar.gz" |
There was a problem hiding this comment.
Do you think it would be possible and meaningful to publish an attested source artifact for Homebrew and verify its provenance before Cargo builds it? This pinned SHA-256 checks the downloaded bytes, but the release's current attestations.jsonl covers the prebuilt coop-*.tar.gz assets, not this GitHub-generated source archive. It seems this would require a release-workflow source artifact plus a formula verification step, and would give source installs a stronger provenance signal.
There was a problem hiding this comment.
Homebrew natively supports attestations with bottles (pre-built releases), so I'd rather not reinvent the wheel (!) and use that instead. This would just mean publishing an Apple Silicon bottle alongside the other releases. WDYT?
|
Review coverage: I left three inline comments—two about test coverage for Homebrew ownership/background-check behavior, and one exploratory question about source provenance. I reviewed correctness, design, conventions, security, API usage, tests, docs, and comments. The macOS arm64 Homebrew build/test job passed. |
Package
coopandcoop-proxywith shell completions and Lima on macOS.Building coop for Homebrew disables background update checks, and direct users to
brewfor upgrades and removal. This initial formula points to v0.9.1 and requires a backport of the build guards, but we can remove them once v0.9.2 ships.(The failing CI should be fixed with #598.)