formula_creator: add deny network to some modes - #23730
Merged
Merged
Conversation
Add `deny_network_access!` to the following modes: * `:cmake` - has been default via trap_fetchcontent_provider.cmake * `:meson` - has been default via `--wrap-mode=nofallback` * `:perl` - build and test dependencies are provided via resources * `:autotools` - these are pre-generated configure scripts and we typically want to prevent network here given prior security incidents * `nil` - if unknown, start without network access as safer default Others can be added after we check if fetching works. Also fix typo in resources portion as `|| :python || :ruby` was always true and drop `:python` which is handled via update-python-resources
Contributor
There was a problem hiding this comment.
Pull request overview
Adds safer default network restrictions to generated formula templates and corrects resource placeholder selection.
Changes:
- Adds
deny_network_access!for Autotools, CMake, Meson, Perl, and generic templates. - Limits resource placeholders to Perl and Ruby templates.
- Adds template-generation coverage for affected modes.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
Library/Homebrew/formula_creator.rb |
Updates generated formula template behavior. |
Library/Homebrew/test/formula_creator_spec.rb |
Tests network and resource template output. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When creating a new formula, add
deny_network_access!to the following modes::cmake- has been default via trap_fetchcontent_provider.cmake:meson- has been default via--wrap-mode=nofallback:perl- build and test dependencies are provided via resources:autotools- these are pre-generated configure scripts and we typically want to prevent network here given prior security incidentsnil- if unknown, start without network access as safer defaultOthers can be added after we check if fetching works.
Also fix typo in resources portion as
|| :python || :rubywas always true and drop:pythonwhich is handled via update-python-resourcesbrew benchmarkresults.brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?n/a