fix: stop Homebrew rewriting bundled dylib IDs on macOS

[cloudsmith-iduffy]

Adds preserve_rpath to the Homebrew formula template so macOS installs stop failing.

Companion to cloudsmith-io/homebrew-cloudsmith-cli#28, which fixed the tap. This change is what stops the next release reverting that fix, because publish-homebrew copies the rendered template over Formula/cloudsmith-cli.rb wholesale.

The bug

Since 1.20.1 the Homebrew formula ships the PyInstaller onedir bundle, so the keg contains 65 prebuilt Mach-O files where the zipapp had none. Homebrew rewrites the dylib ID of every one to an absolute Cellar path, and that name does not fit the header padding of pydantic_core's prebuilt wheel:

Error: Failed changing dylib ID of .../libexec/_internal/pydantic_core/_pydantic_core.cpython-312-darwin.so
  from @rpath/pydantic_core._pydantic_core.cpython-312-darwin.so
    to /opt/homebrew/opt/cloudsmith-cli/libexec/_internal/pydantic_core/pydantic_core._pydantic_core...
Error: Failed to fix install linkage

Measured against the published 1.20.2 archives — the new ID needs 56 more bytes than are available:

archive	header slack	needed	result
arm64 _pydantic_core.so	48 bytes	56	fails
x86_64 _pydantic_core.so	32 bytes	56	fails
arm64 rpds.so	48 bytes	40	passes by 8 bytes

Both macOS architectures are affected, and the margin elsewhere is thin. The install does link and the CLI runs, but brew exits non-zero, which breaks brew upgrade and any automation around it. Reported by a customer upgrading 1.19.0 → 1.20.1.

Why preserve_rpath rather than a build change

_pydantic_core.so is a prebuilt maturin wheel from PyPI that PyInstaller copies verbatim, so linking it with -headerpad_max_install_names would mean building pydantic-core from source.

The rewrite is also pointless. Every non-system linkage in the bundle is @rpath-relative and private to it, and nothing outside links against them. Homebrew already skips @rpath install names and rpaths via grep_v(VARIABLE_REFERENCE_RX); the dylib ID is the one path lacking that exemption, and preserve_rpath supplies it. All six dylibs in the bundle use @rpath IDs, so it covers every one.

Verification

Rendered with 1.20.2's version and checksums, this template produces a formula byte-identical to the one merged in the tap, and:

• brew style — no offenses
• brew audit — clean
• the tap's macOS CI installs, uninstalls, upgrades, downgrades and pins it on both arm64 and Intel

Before the fix the install reproduced the error above and exited 1; after it, exit 0 with all six dylib IDs left as @rpath.

🤖 Generated with Claude Code

[Copilot]

🟢 Ready to approve

The change is narrowly scoped to the Homebrew formula template and aligns with the stated install failure mode without introducing additional logic or surface area.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Updates the Homebrew formula template used by the release workflow so macOS Homebrew installs of the PyInstaller onedir bundle don’t fail due to Homebrew rewriting Mach-O linkage metadata.

Changes:

• Adds the preserve_rpath directive to the Homebrew formula template to prevent rewriting @rpath-based linkage.
• Documents (in-formula) the rationale tied to Mach-O header padding constraints in prebuilt wheels (e.g., pydantic_core).

File summaries

File	Description
packaging/homebrew/cloudsmith-cli.rb.tmpl	Adds preserve_rpath (with explanatory comment) to avoid Homebrew rewriting @rpath-based dylib IDs during macOS installs.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.