Merge pull request #162 from ELD/update-brew-src

brew-src: 6.0.11 -> 6.0.12

README.md

@@ -64,6 +64,17 @@ If you haven't installed Homebrew before, use the following configuration:
             #
             # With mutableTaps disabled, taps can no longer be added imperatively with `brew tap`.
             mutableTaps = false;
+
+            # Optional: Declarative Homebrew tap trust entries.
+            #
+            # Note: The trust entries are _not_ removed if you remove them from those lists!
+            # Use the `brew untrust` command to remove a trust entry.
+            trust = {
+              formulae = [ ];
+              casks = [ ];
+              commands = [ ];
+              taps = [ ];
+            };
           };
         }
         # Optional: Align homebrew taps config with nix-homebrew
@@ -83,6 +94,25 @@ With `nix-homebrew.mutableTaps = false`, taps can be removed by deleting the cor
 
 Setting `homebrew.taps` to equal `nix-homebrew.taps` attribute names reduces configuration mismatches. 
 
+For non-official taps, Homebrew requires [explicit trust](https://docs.brew.sh/Tap-Trust).
+You may use imperative `brew trust`/`brew untrust` commands, or configure `nix-homebrew` to add trust entries during activation:
+
+```nix
+nix-homebrew.trust = {
+  formulae = [ "user/repo/formula" ];
+  casks = [ "user/repo/cask" ];
+  commands = [ "user/repo/command" ];
+
+  # To quote upstream documentation:
+  # > Trust a whole tap only when you are comfortable with all current and
+  # > future formulae, casks and external commands from that tap being loaded
+  # > by Homebrew.
+  taps = [ "user/repo" ];
+};
+```
+Note that when you remove items from those lists, the corresponding trust entries are _not_ removed automatically.
+Use the `brew untrust` command to remove a trust entry.
+
 ### B. Existing Homebrew Installation
 
 If you've already installed Homebrew with the official script, you can let `nix-homebrew` automatically migrate it:

ci/flake.lock

@@ -16,21 +16,21 @@
         "type": "github"
       }
     },
-    "nix-darwin_25_11": {
+    "nix-darwin_26_05": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1772129556,
-        "narHash": "sha256-Utk0zd8STPsUJPyjabhzPc5BpPodLTXrwkpXBHYnpeg=",
+        "lastModified": 1780789116,
+        "narHash": "sha256-+/LcDMJGYQVLp3ECZ1jBhj3GcQU+Yt+OTsDsQFz8cMs=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "ebec37af18215214173c98cf6356d0aca24a2585",
+        "rev": "731951a251ca96cbd12a8e1bde63737e21947644",
         "type": "github"
       },
       "original": {
         "owner": "nix-darwin",
-        "ref": "nix-darwin-25.11",
+        "ref": "nix-darwin-26.05",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -75,16 +75,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764491476,
-        "narHash": "sha256-E4rtgPS7fntINb6fVJ5qQdkhfbZn8pzMYNdmiXqZmCo=",
+        "lastModified": 1779622335,
+        "narHash": "sha256-ViA62qtL5za7V3d5I8OA9q9JcFhsVAiL5jVHwEclWqk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54f09efd2ca0dd5bb9c5fafc89573ab3ac44701d",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-25.11-darwin",
+        "ref": "nixpkgs-26.05-darwin",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -105,18 +105,18 @@
         "type": "github"
       }
     },
-    "nixpkgs_25_11": {
+    "nixpkgs_26_05": {
       "locked": {
-        "lastModified": 1774388614,
-        "narHash": "sha256-tFwzTI0DdDzovdE9+Ras6CUss0yn8P9XV4Ja6RjA+nU=",
+        "lastModified": 1780902259,
+        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1073dad219cb244572b74da2b20c7fe39cb3fa9e",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -140,10 +140,10 @@
     "root": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nix-darwin_25_11": "nix-darwin_25_11",
+        "nix-darwin_26_05": "nix-darwin_26_05",
         "nix-darwin_unstable": "nix-darwin_unstable",
         "nix-github-actions": "nix-github-actions",
-        "nixpkgs_25_11": "nixpkgs_25_11",
+        "nixpkgs_26_05": "nixpkgs_26_05",
         "nixpkgs_unstable": "nixpkgs_unstable"
       }
     }

ci/flake.nix

@@ -2,10 +2,10 @@
 {
   inputs = {
     nixpkgs_unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs_25_11.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05";
 
     nix-darwin_unstable.url = "github:nix-darwin/nix-darwin";
-    nix-darwin_25_11.url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
+    nix-darwin_26_05.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
 
     nix-github-actions = {
       url = "github:nix-community/nix-github-actions";
@@ -31,9 +31,9 @@
           nixpkgs = inputs.nixpkgs_unstable;
           nix-darwin = inputs.nix-darwin_unstable;
         };
-        "25.11" = {
-          nixpkgs = inputs.nixpkgs_25_11;
-          nix-darwin = inputs.nix-darwin_25_11;
+        "26.05" = {
+          nixpkgs = inputs.nixpkgs_26_05;
+          nix-darwin = inputs.nix-darwin_26_05;
         };
       };
 
@@ -112,7 +112,7 @@
             pkgs:
             pkgs.mkShell {
               nativeBuildInputs = with pkgs; [
-                nixfmt-rfc-style
+                nixfmt
               ];
 
               BREW_SRC = brew-src;

ci/tests.nix

@@ -67,6 +67,88 @@ let
         )
       ];
     };
+
+  makeTapValidationTest =
+    module:
+    makeTest (
+      { pkgs, config, ... }:
+      let
+        prefixName =
+          if pkgs.stdenv.hostPlatform.isAarch64 then
+            config.nix-homebrew.defaultArm64Prefix
+          else
+            config.nix-homebrew.defaultIntelPrefix;
+        library = config.nix-homebrew.prefixes.${prefixName}.library;
+        fakeCaskTap = pkgs.runCommandLocal "homebrew-cask-test-tap" { } ''
+          mkdir -p "$out/Casks/u"
+          touch "$out/Casks/u/ungoogled-chromium.rb"
+        '';
+        fakeThirdPartyTap = pkgs.runCommandLocal "thirdparty-test-tap" { } ''
+          mkdir -p "$out/Formula" "$out/Casks" "$out/cmd"
+          touch "$out/Formula/foo.rb"
+          touch "$out/Casks/test-cask.rb"
+          touch "$out/cmd/brew-test-command.rb"
+        '';
+      in
+      {
+        imports = [
+          module
+        ];
+
+        _module.args.library = library;
+
+        nix-homebrew = {
+          enable = true;
+          autoMigrate = true;
+          taps = {
+            "homebrew/homebrew-cask" = fakeCaskTap;
+            "thirdparty/homebrew-testtap" = fakeThirdPartyTap;
+          };
+          trust = {
+            formulae = [ "thirdparty/testtap/foo" ];
+            casks = [ "thirdparty/testtap/test-cask" ];
+            commands = [ "thirdparty/testtap/test-command" ];
+          };
+        };
+
+        ci.preScript = ''
+          >&2 echo "Removing runner Homebrew taps before declarative tap validation"
+          if [[ -e "${library}/Taps" || -L "${library}/Taps" ]]; then
+            sudo rm -rf "${library}/Taps"
+          fi
+        '';
+
+        ci.postScript = ''
+          >&2 echo "Checking declarative cask tap realpaths"
+          tap_root="${library}/Taps"
+          cask_path="$tap_root/homebrew/homebrew-cask/Casks/u/ungoogled-chromium.rb"
+
+          test -f "$cask_path"
+
+          >&2 echo "Checking declarative Homebrew trust entries"
+          brew trust --json=v1 --formula | grep '"thirdparty/testtap/foo"'
+          brew trust --json=v1 --cask | grep '"thirdparty/testtap/test-cask"'
+          brew trust --json=v1 --command | grep '"thirdparty/testtap/test-command"'
+          if brew trust --json=v1 --tap | grep '"thirdparty/testtap"'; then
+            >&2 echo "Expected thirdparty/testtap not to be trusted as a whole tap"
+            exit 1
+          fi
+
+          tap_root_real="$(${pkgs.coreutils}/bin/realpath "$tap_root")"
+          cask_real="$(${pkgs.coreutils}/bin/realpath "$cask_path")"
+
+          case "$cask_real" in
+            "$tap_root_real"/*) ;;
+            *)
+              >&2 echo "Expected cask realpath to stay under managed Taps root"
+              >&2 echo "Taps realpath: $tap_root_real"
+              >&2 echo "Cask realpath: $cask_real"
+              exit 1
+              ;;
+          esac
+        '';
+      }
+    );
 in
 {
   migrate = makeTest (
@@ -89,13 +171,15 @@ in
       ci.postScript = ''
         >&2 echo "Checking brew"
         which brew
-      '' + lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
+      ''
+      + lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
         >&2 echo "Checking that we can still use the unbound package"
         $(brew --prefix)/sbin/unbound -V
 
         >&2 echo "Checking that we can still use the tap we added imperatively"
         brew install koekeishiya/formulae/yabai
-      '' + lib.optionalString config.nix-homebrew.enableRosetta ''
+      ''
+      + lib.optionalString config.nix-homebrew.enableRosetta ''
         >&2 echo "Checking we can execute the Intel brew with arch -x86_64"
         arch -x86_64 /usr/local/bin/brew config | grep "HOMEBREW_PREFIX: /usr/local"
 
@@ -106,6 +190,22 @@ in
     }
   );
 
+  tap-validation-mutable = makeTapValidationTest { };
+
+  tap-validation-declarative = makeTapValidationTest (
+    { library, ... }:
+    {
+      nix-homebrew.mutableTaps = false;
+
+      ci.preScript = ''
+        >&2 echo "Removing runner Homebrew taps before declarative tap validation"
+        if [[ -e "${library}/Taps" || -L "${library}/Taps" ]]; then
+          sudo rm -rf "${library}/Taps"
+        fi
+      '';
+    }
+  );
+
   nuke-homebrew-repository = makeTest {
     ci.script = lib.mkForce ''
       cat "${tools.nuke-homebrew-repository.passthru.tests.test-nuke}"

flake.lock

@@ -3,16 +3,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1774235677,
-        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
+        "lastModified": 1784558651,
+        "narHash": "sha256-woXJ1ATKpSYRWCy46TQJjmm9XzAeZVEZw9xDfVG9NYI=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
+        "rev": "b48c7994b5f0eed7bef532efa63cb4e4f763887a",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.1.1",
+        "ref": "6.0.12",
         "repo": "brew",
         "type": "github"
       }

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     brew-src = {
-      url = "github:Homebrew/brew/5.1.1";
+      url = "github:Homebrew/brew/6.0.12";
       flake = false;
     };
   };

modules/brew.tail.sh

@@ -112,15 +112,19 @@ done
 
 # We don't want to take the user's value for, e.g., `HOMEBREW_PATH` here!
 USED_BY_HOMEBREW_VARS=(
+  CARGO_HOME
+  CARGO_INSTALL_ROOT
   CODESPACES
   COLORTERM
   DBUS_SESSION_BUS_ADDRESS
   GOBIN
   GOPATH
+  LANG
   NODENV_ROOT
   PATH
   PYENV_ROOT
   RBENV_ROOT
+  RUSTUP_HOME
   SSH_TTY
   SUDO_USER
   TMPDIR
@@ -130,6 +134,7 @@ USED_BY_HOMEBREW_VARS=(
   XDG_CACHE_HOME
   XDG_CONFIG_HOME
   XDG_DATA_DIRS
+  XDG_DATA_HOME
   XDG_RUNTIME_DIR
   ZDOTDIR
 )

modules/default.nix

@@ -252,6 +252,19 @@ let
       exit 1
     fi
     /bin/ln -shf "${makeBinBrew prefix}" "$BIN_BREW"
+
+    ${setupTrust}
+  '';
+
+  setupTrust = let
+    trustEntries = flag: entries: lib.concatMapStrings (entry: ''
+      /usr/bin/sudo -n -u ${lib.escapeShellArg cfg.user} -H "$BIN_BREW" trust ${flag} ${lib.escapeShellArg entry} >/dev/null
+    '') entries;
+  in ''
+    ${trustEntries "--tap" cfg.trust.taps}
+    ${trustEntries "--formula" cfg.trust.formulae}
+    ${trustEntries "--cask" cfg.trust.casks}
+    ${trustEntries "--command" cfg.trust.commands}
   '';
 
   setupTaps = taps:
@@ -268,24 +281,31 @@ let
         error "$tty_underline${namespaceDir}$tty_reset is in the way and needs to be moved out for $tty_underline${path}$tty_reset"
         exit 1
       fi
-      if is_occupied "${tapDir}"; then
+      if [[ -L "${tapDir}" ]]; then
+        rm "${tapDir}"
+      elif [[ -d "${tapDir}" ]]; then
+        :
+        # directory
+      elif is_occupied "${tapDir}"; then
         error "An existing $tty_underline${tapDir}$tty_reset is in the way"
         exit 1
       fi
       "''${MKDIR[@]}" "${namespaceDir}"
       "''${CHOWN[@]}" "$NIX_HOMEBREW_UID:$NIX_HOMEBREW_GID" "${namespaceDir}"
       "''${CHMOD[@]}" "ug=rwx" "${namespaceDir}"
-      /bin/ln -shf "${target}" "${tapDir}"
+      /usr/bin/rsync -rL --delete "${target}/" "${tapDir}"
     '') (builtins.attrNames taps)
 
     # Fully declarative taps
     else let
-      env = pkgs.runCommandLocal "taps-env" {} (lib.concatMapStrings (path: let
+      env = pkgs.runCommandLocal "taps-env" { } (''
+        mkdir -p "$out"
+      '' + lib.concatMapStrings (path: let
         namespace = builtins.head (lib.splitString "/" path);
         target = taps.${path};
       in ''
         mkdir -p "$out/${namespace}"
-        ln -s "${target}" "$out/${path}"
+        cp -RH "${target}" "$out/${path}"
       '') (builtins.attrNames taps));
     in ''
       if is_occupied "$HOMEBREW_LIBRARY/Taps"; then
@@ -383,6 +403,68 @@ in {
         type = types.bool;
         default = true;
       };
+      trust = lib.mkOption {
+        description = ''
+          Tap trust entries to be added during activation.
+
+          Note: The trust entries are _not_ removed if you remove them from
+          those lists! Use the `brew untrust` command to remove a trust entry.
+
+          Refer to upstream documentations for more information:
+          <https://docs.brew.sh/Tap-Trust>
+        '';
+        type = types.submodule {
+          options = {
+            taps = lib.mkOption {
+              description = ''
+                Taps to trust in their entirety.
+
+                This should be used with caution. To quote upstream documentation:
+
+                > Trust a whole tap only when you are comfortable with all current and
+                > future formulae, casks and external commands from that tap being loaded
+                > by Homebrew.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo"
+              ];
+            };
+            formulae = lib.mkOption {
+              description = ''
+                Fully-qualified formulae to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/formula"
+              ];
+            };
+            casks = lib.mkOption {
+              description = ''
+                Fully-qualified casks to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/cask"
+              ];
+            };
+            commands = lib.mkOption {
+              description = ''
+                Fully-qualified external commands to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/command"
+              ];
+            };
+          };
+        };
+        default = {};
+      };
       autoMigrate = lib.mkOption {
         description = ''
           Whether to allow nix-homebrew to automatically migrate existing Homebrew installations.

pkgs/nuke-homebrew-repository/nuke-homebrew-repository.sh.in

@@ -30,7 +30,7 @@ if [[ ! -e ".git" ]]; then
   exit 1
 fi
 
-if ! grep -E "^# Homebrew" "README.md" >/dev/null; then
+if ! grep -E "^#.*Homebrew" "README.md" >/dev/null; then
   >&2 echo "${PWD} does not looks like a Homebrew checkout"
   exit 1
 fi