From 2ad614e59ee398dddfea564f8e8068e1f83bb6f9 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Date: Wed, 5 Aug 2026 13:59:24 -0400 Subject: [PATCH] Pin the Homebrew installer to a commit SHA (dev#99) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bootstrap script piped Homebrew/install's HEAD to bash inside every image build — third-party code on a mutable ref an upstream compromise could repoint. Pin to the current commit; the repo publishes no tags, and a stale pin fails benign (it still installs current Homebrew). dev's own fetches stay unpinned by design: the script curl from main is review-gated (org ruleset: PR + 1 review, no force-push, bot bypass removed), and the brew formula already checksums each release tarball. Co-authored-by: Cursor --- bin/docker-install-build-deps.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/bin/docker-install-build-deps.sh b/bin/docker-install-build-deps.sh index 6d988c7..42a26a9 100755 --- a/bin/docker-install-build-deps.sh +++ b/bin/docker-install-build-deps.sh @@ -26,7 +26,12 @@ DEV_REF="${DEV_REF:-}" export HOMEBREW_NO_SANDBOX_LINUX=1 echo ">>> Installing Linuxbrew" -NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" +# Pinned to a Homebrew/install commit rather than HEAD: this pipes +# third-party code to bash inside every image build, and HEAD is a mutable +# ref an upstream compromise could repoint (dev#99). The repo publishes no +# tags, so the pin is a commit SHA; bump it deliberately when a newer +# installer is needed — a stale pin still installs current Homebrew. +NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/24173182915f24bdd52a22fd073e421953b2a252/install.sh)" eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" # dev requires Ruby >= 3.1; distro rubies are often older (Ubuntu 22.04 ships