Merge pull request #162 from ELD/update-brew-src

brew-src: 6.0.11 -> 6.0.12

.github/workflows/ci.yaml

@@ -5,41 +5,36 @@ on:
   pull_request:
 
 jobs:
-  check:
+  nix-matrix:
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: samueldr/lix-gha-installer-action@v2025-10-27
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - id: set-matrix
-
+        name: Generate Nix Matrix
-      - name: Test nuke-homebrew-repository
         run: |
-          nix build .#nuke-homebrew-repository.passthru.tests.test-nuke -L
+          set -Eeu
-
+          matrix="$(nix eval --json '.#githubActions.matrix')"
-      - name: Install some package with Homebrew
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
-        run: |
+  check:
-          brew install unbound
+    name: ${{ matrix.name }} (${{ matrix.system }})
-
+    needs: nix-matrix
-      - name: Add a third-party tap imperatively
+    runs-on: ${{ matrix.os }}
-        run: |
+    strategy:
-          brew tap koekeishiya/formulae
+      matrix: ${{fromJSON(needs.nix-matrix.outputs.matrix)}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: samueldr/lix-gha-installer-action@v2025-10-27
 
       - name: Set up /run for nix-darwin
         run: |
           printf 'run\tprivate/var/run\n' | sudo tee -a /etc/synthetic.conf
           sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
 
-      - name: Migrate existing Homebrew installation (imperative taps)
+      - name: Run test
         run: |
-          sudo rm /etc/bashrc
+          export NIX_HOMEBREW_CI=1
-          ./ci/activate-example.sh migrate
+          ci_script=$(nix build -L '.#${{ matrix.attr }}' --print-out-paths)
-
+          "$ci_script"
-      - name: Check that we can still use the unbound package
-        run: $(brew --prefix)/sbin/unbound -V
-
-      - name: Check that we can still use the tap that we added imperatively
-        run: brew install koekeishiya/formulae/yabai
-
-      #- name: Migrate to fully-declarative tap management
-      #  run: |
-      #    false

README.md

@@ -15,7 +15,7 @@ Add the following to your Flake inputs:
 ```nix
 {
   inputs = {
-    nix-homebrew.url = "github:zhaofengli-wip/nix-homebrew";
+    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
 
     # Optional: Declarative tap management
     homebrew-core = {
@@ -64,8 +64,23 @@ If you haven't installed Homebrew before, use the following configuration:
             #
             # With mutableTaps disabled, taps can no longer be added imperatively with `brew tap`.
             mutableTaps = false;
+
+            # Optional: Declarative Homebrew tap trust entries.
+            #
+            # Note: The trust entries are _not_ removed if you remove them from those lists!
+            # Use the `brew untrust` command to remove a trust entry.
+            trust = {
+              formulae = [ ];
+              casks = [ ];
+              commands = [ ];
+              taps = [ ];
+            };
           };
         }
+        # Optional: Align homebrew taps config with nix-homebrew
+        ({config, ...}: {
+          homebrew.taps = builtins.attrNames config.nix-homebrew.taps;
+        })
       ];
     };
   };
@@ -77,6 +92,27 @@ Run `arch -x86_64 brew` to install X86-64 packages through Rosetta 2.
 
 With `nix-homebrew.mutableTaps = false`, taps can be removed by deleting the corresponding attribute in `nix-homebrew.taps` and activating the new configuration.
 
+Setting `homebrew.taps` to equal `nix-homebrew.taps` attribute names reduces configuration mismatches. 
+
+For non-official taps, Homebrew requires [explicit trust](https://docs.brew.sh/Tap-Trust).
+You may use imperative `brew trust`/`brew untrust` commands, or configure `nix-homebrew` to add trust entries during activation:
+
+```nix
+nix-homebrew.trust = {
+  formulae = [ "user/repo/formula" ];
+  casks = [ "user/repo/cask" ];
+  commands = [ "user/repo/command" ];
+
+  # To quote upstream documentation:
+  # > Trust a whole tap only when you are comfortable with all current and
+  # > future formulae, casks and external commands from that tap being loaded
+  # > by Homebrew.
+  taps = [ "user/repo" ];
+};
+```
+Note that when you remove items from those lists, the corresponding trust entries are _not_ removed automatically.
+Use the `brew untrust` command to remove a trust entry.
+
 ### B. Existing Homebrew Installation
 
 If you've already installed Homebrew with the official script, you can let `nix-homebrew` automatically migrate it:

ci/activate-example.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-DIR=$(dirname $0)
-
-if [[ "$#" != "1" ]]; then
-  >&2 echo "Usage: $0 [example]"
-  exit 1
-fi
-example="$1"
-
-system="$(nix eval --raw --impure --expr 'builtins.currentSystem')"
->&2 echo "System: ${system}"
-
-systemProfile="$(nix build "./${DIR}/..#ci.${system}.${example}.system" -L --no-link --print-out-paths)"
->&2 echo "Built $systemProfile"
-
-sudo rm "/etc/nix/nix.conf"
-sudo "$systemProfile/activate"
-"$systemProfile/activate-user"
-
-# vim: set et ts=2 sw=2:

ci/default.nix

@@ -1,23 +0,0 @@
-# Activates example configurations on CI
-
-{ self, pkgs, nix-darwin, ... }:
-
-let
-  inherit (pkgs) lib system;
-  makeProfile = example: nix-darwin.lib.darwinSystem {
-    inherit system pkgs;
-    modules = [
-      self.darwinModules.nix-homebrew
-      (../examples + "/${example}.nix")
-      {
-        documentation.enable = false;
-        services.nix-daemon.enable = true;
-        nix-homebrew = {
-          user = lib.mkForce "runner";
-        };
-      }
-    ];
-  };
-in {
-  migrate = makeProfile "migrate";
-}

ci/flake-compat.nix

@@ -0,0 +1,11 @@
+let
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  flakeCompat = import (fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+    sha256 = lock.nodes.flake-compat.locked.narHash;
+  });
+  flake = flakeCompat {
+    src = ./.;
+  };
+in
+flake.defaultNix.outputs

ci/flake.lock

@@ -0,0 +1,153 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "nix-darwin_26_05": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1780789116,
+        "narHash": "sha256-+/LcDMJGYQVLp3ECZ1jBhj3GcQU+Yt+OTsDsQFz8cMs=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "731951a251ca96cbd12a8e1bde63737e21947644",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "ref": "nix-darwin-26.05",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-darwin_unstable": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1773000227,
+        "narHash": "sha256-zm3ftUQw0MPumYi91HovoGhgyZBlM4o3Zy0LhPNwzXE=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "da529ac9e46f25ed5616fd634079a5f3c579135f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs_unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1779622335,
+        "narHash": "sha256-ViA62qtL5za7V3d5I8OA9q9JcFhsVAiL5jVHwEclWqk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1765934234,
+        "narHash": "sha256-pJjWUzNnjbIAMIc5gRFUuKCDQ9S1cuh3b2hKgA7Mc4A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "af84f9d270d404c17699522fab95bbf928a2d92f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_26_05": {
+      "locked": {
+        "lastModified": 1780902259,
+        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_unstable": {
+      "locked": {
+        "lastModified": 1774386573,
+        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nix-darwin_26_05": "nix-darwin_26_05",
+        "nix-darwin_unstable": "nix-darwin_unstable",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs_26_05": "nixpkgs_26_05",
+        "nixpkgs_unstable": "nixpkgs_unstable"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

ci/flake.nix

@@ -0,0 +1,130 @@
+# Only used for development & CI
+{
+  inputs = {
+    nixpkgs_unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs_26_05.url = "github:NixOS/nixpkgs/nixos-26.05";
+
+    nix-darwin_unstable.url = "github:nix-darwin/nix-darwin";
+    nix-darwin_26_05.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
+
+    nix-github-actions = {
+      url = "github:nix-community/nix-github-actions";
+      inputs.nixpkgs.follows = "nixpkgs_unstable";
+    };
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
+  };
+  outputs =
+    inputs:
+    let
+      inherit (inputs.nixpkgs_unstable) lib;
+
+      supportedSystems = [
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+
+      releases = {
+        "unstable" = {
+          nixpkgs = inputs.nixpkgs_unstable;
+          nix-darwin = inputs.nix-darwin_unstable;
+        };
+        "26.05" = {
+          nixpkgs = inputs.nixpkgs_26_05;
+          nix-darwin = inputs.nix-darwin_26_05;
+        };
+      };
+
+      githubPlatforms = {
+        "aarch64-darwin" = "macos-26";
+        "x86_64-darwin" = "macos-26";
+      };
+
+      matrix =
+        let
+          names = {
+            release = builtins.attrNames releases;
+            test = builtins.attrNames (
+              import ./tests.nix {
+                self = null;
+                pkgs = null;
+                nix-darwin = null;
+              }
+            );
+          };
+        in
+        lib.pipe names [
+          lib.cartesianProduct
+          (map (setup: {
+            name = "${setup.test}-${setup.release}";
+            value = setup;
+          }))
+          lib.listToAttrs
+        ];
+
+      forAllSystems =
+        f: lib.genAttrs supportedSystems (system: f inputs.nixpkgs_unstable.legacyPackages.${system});
+
+      makeCi =
+        { self, brew-src }:
+        let
+          assembleTest =
+            {
+              system,
+              release,
+              test,
+            }:
+            let
+              inputs' = releases.${release};
+              pkgs = inputs'.nixpkgs.legacyPackages.${system};
+              tests = import ./tests.nix {
+                inherit self pkgs;
+                inherit (inputs') nix-darwin;
+              };
+            in
+            tests.${test};
+
+          ciTests = lib.genAttrs supportedSystems (
+            system:
+            lib.mapAttrs (
+              name:
+              { release, test }:
+              assembleTest {
+                inherit system release test;
+              }
+            ) matrix
+          );
+          ciScripts = lib.mapAttrs (
+            system: tests: lib.mapAttrs (name: test: test.config.system.build.ci-script) tests
+          ) ciTests;
+        in
+        {
+          inherit ciTests;
+          packages = forAllSystems (
+            pkgs:
+            pkgs.callPackages (self + "/pkgs") {
+              inherit brew-src;
+            }
+          );
+          devShell = forAllSystems (
+            pkgs:
+            pkgs.mkShell {
+              nativeBuildInputs = with pkgs; [
+                nixfmt
+              ];
+
+              BREW_SRC = brew-src;
+            }
+          );
+          githubActions = inputs.nix-github-actions.lib.mkGithubMatrix {
+            checks = ciScripts;
+            platforms = githubPlatforms;
+          };
+        };
+    in
+    {
+      inherit makeCi;
+    };
+}

ci/tests.nix

@@ -0,0 +1,214 @@
+{
+  self,
+  pkgs,
+  nix-darwin,
+}:
+
+let
+  inherit (pkgs) lib system;
+
+  tools = self.packages.${pkgs.system};
+
+  makeTest =
+    module:
+    nix-darwin.lib.darwinSystem {
+      inherit system pkgs;
+      modules = [
+        self.darwinModules.nix-homebrew
+        module
+        (
+          {
+            pkgs,
+            lib,
+            config,
+            ...
+          }:
+          {
+            options = {
+              ci = {
+                preScript = lib.mkOption {
+                  type = lib.types.lines;
+                  default = "";
+                };
+                script = lib.mkOption {
+                  type = lib.types.lines;
+                  default = ''
+                    sudo rm -f /etc/bashrc /etc/nix/nix.conf /etc/nix/nix.custom.conf
+                    sudo "${config.system.build.toplevel}/activate"
+                    export PATH=/run/current-system/sw/bin:$PATH
+                  '';
+                };
+                postScript = lib.mkOption {
+                  type = lib.types.lines;
+                  default = "";
+                };
+              };
+            };
+            config = {
+              documentation.enable = false;
+              system.stateVersion = 6;
+              nix-homebrew = {
+                user = lib.mkForce "runner";
+              };
+
+              system.build.ci-script = pkgs.writeShellScript "ci-script.sh" ''
+                set -euo pipefail
+                if [[ -z "''${NIX_HOMEBREW_CI:-}" ]]; then
+                  >&2 echo "This script can only be run on nix-homebrew CI."
+                  exit 1
+                fi
+                set -x
+                ${config.ci.preScript}
+                ${config.ci.script}
+                ${config.ci.postScript}
+              '';
+            };
+          }
+        )
+      ];
+    };
+
+  makeTapValidationTest =
+    module:
+    makeTest (
+      { pkgs, config, ... }:
+      let
+        prefixName =
+          if pkgs.stdenv.hostPlatform.isAarch64 then
+            config.nix-homebrew.defaultArm64Prefix
+          else
+            config.nix-homebrew.defaultIntelPrefix;
+        library = config.nix-homebrew.prefixes.${prefixName}.library;
+        fakeCaskTap = pkgs.runCommandLocal "homebrew-cask-test-tap" { } ''
+          mkdir -p "$out/Casks/u"
+          touch "$out/Casks/u/ungoogled-chromium.rb"
+        '';
+        fakeThirdPartyTap = pkgs.runCommandLocal "thirdparty-test-tap" { } ''
+          mkdir -p "$out/Formula" "$out/Casks" "$out/cmd"
+          touch "$out/Formula/foo.rb"
+          touch "$out/Casks/test-cask.rb"
+          touch "$out/cmd/brew-test-command.rb"
+        '';
+      in
+      {
+        imports = [
+          module
+        ];
+
+        _module.args.library = library;
+
+        nix-homebrew = {
+          enable = true;
+          autoMigrate = true;
+          taps = {
+            "homebrew/homebrew-cask" = fakeCaskTap;
+            "thirdparty/homebrew-testtap" = fakeThirdPartyTap;
+          };
+          trust = {
+            formulae = [ "thirdparty/testtap/foo" ];
+            casks = [ "thirdparty/testtap/test-cask" ];
+            commands = [ "thirdparty/testtap/test-command" ];
+          };
+        };
+
+        ci.preScript = ''
+          >&2 echo "Removing runner Homebrew taps before declarative tap validation"
+          if [[ -e "${library}/Taps" || -L "${library}/Taps" ]]; then
+            sudo rm -rf "${library}/Taps"
+          fi
+        '';
+
+        ci.postScript = ''
+          >&2 echo "Checking declarative cask tap realpaths"
+          tap_root="${library}/Taps"
+          cask_path="$tap_root/homebrew/homebrew-cask/Casks/u/ungoogled-chromium.rb"
+
+          test -f "$cask_path"
+
+          >&2 echo "Checking declarative Homebrew trust entries"
+          brew trust --json=v1 --formula | grep '"thirdparty/testtap/foo"'
+          brew trust --json=v1 --cask | grep '"thirdparty/testtap/test-cask"'
+          brew trust --json=v1 --command | grep '"thirdparty/testtap/test-command"'
+          if brew trust --json=v1 --tap | grep '"thirdparty/testtap"'; then
+            >&2 echo "Expected thirdparty/testtap not to be trusted as a whole tap"
+            exit 1
+          fi
+
+          tap_root_real="$(${pkgs.coreutils}/bin/realpath "$tap_root")"
+          cask_real="$(${pkgs.coreutils}/bin/realpath "$cask_path")"
+
+          case "$cask_real" in
+            "$tap_root_real"/*) ;;
+            *)
+              >&2 echo "Expected cask realpath to stay under managed Taps root"
+              >&2 echo "Taps realpath: $tap_root_real"
+              >&2 echo "Cask realpath: $cask_real"
+              exit 1
+              ;;
+          esac
+        '';
+      }
+    );
+in
+{
+  migrate = makeTest (
+    { pkgs, config, ... }:
+    {
+      imports = [
+        (self + "/examples/migrate.nix")
+      ];
+      nix-homebrew.enableRosetta = lib.mkForce pkgs.stdenv.hostPlatform.isAarch64;
+
+      # We only have Apple Silicon instances - Only test the install steps on native
+      # Apple Silicon for now
+      ci.preScript = lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
+        >&2 echo "Installing some package with Homebrew"
+        brew install unbound
+
+        >&2 echo "Adding a third-party tap imperatively"
+        brew tap koekeishiya/formulae
+      '';
+      ci.postScript = ''
+        >&2 echo "Checking brew"
+        which brew
+      ''
+      + lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
+        >&2 echo "Checking that we can still use the unbound package"
+        $(brew --prefix)/sbin/unbound -V
+
+        >&2 echo "Checking that we can still use the tap we added imperatively"
+        brew install koekeishiya/formulae/yabai
+      ''
+      + lib.optionalString config.nix-homebrew.enableRosetta ''
+        >&2 echo "Checking we can execute the Intel brew with arch -x86_64"
+        arch -x86_64 /usr/local/bin/brew config | grep "HOMEBREW_PREFIX: /usr/local"
+
+        >&2 echo "Checking that the unified brew launcher selects the correct prefix"
+        arch -arm64 brew config | grep "HOMEBREW_PREFIX: /opt/homebrew"
+        arch -x86_64 brew config | grep "HOMEBREW_PREFIX: /usr/local"
+      '';
+    }
+  );
+
+  tap-validation-mutable = makeTapValidationTest { };
+
+  tap-validation-declarative = makeTapValidationTest (
+    { library, ... }:
+    {
+      nix-homebrew.mutableTaps = false;
+
+      ci.preScript = ''
+        >&2 echo "Removing runner Homebrew taps before declarative tap validation"
+        if [[ -e "${library}/Taps" || -L "${library}/Taps" ]]; then
+          sudo rm -rf "${library}/Taps"
+        fi
+      '';
+    }
+  );
+
+  nuke-homebrew-repository = makeTest {
+    ci.script = lib.mkForce ''
+      cat "${tools.nuke-homebrew-repository.passthru.tests.test-nuke}"
+    '';
+  };
+}

flake.lock

@@ -3,72 +3,23 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1742457334,
+        "lastModified": 1784558651,
-        "narHash": "sha256-Gn7ruyb3NDFr+SsHBfA2NsJI8YkkWdECqLRj/xcjt+E=",
+        "narHash": "sha256-woXJ1ATKpSYRWCy46TQJjmm9XzAeZVEZw9xDfVG9NYI=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "f3bd91d3afe086824d24708230e1f0c7f943135a",
+        "rev": "b48c7994b5f0eed7bef532efa63cb4e4f763887a",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "4.4.25",
+        "ref": "6.0.12",
         "repo": "brew",
         "type": "github"
       }
     },
-    "nix-darwin": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1716329735,
-        "narHash": "sha256-ap51w+VqG21vuzyQ04WrhI2YbWHd3UGz0e7dc/QQmoA=",
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "rev": "eac4f25028c1975a939c8f8fba95c12f8a25e01c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "LnL7",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1687274257,
-        "narHash": "sha256-TutzPriQcZ8FghDhEolnHcYU2oHIG5XWF+/SUBNnAOE=",
-        "path": "/nix/store/22qgs3skscd9bmrxv9xv4q5d4wwm5ppx-source",
-        "rev": "2c9ecd1f0400076a4d6b2193ad468ff0a7e7fdc5",
-        "type": "path"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1716330097,
-        "narHash": "sha256-8BO3B7e3BiyIDsaKA0tY8O88rClYRTjvAp66y+VBUeU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5710852ba686cc1fd0d3b8e22b3117d43ba374c2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
-        "brew-src": "brew-src",
+        "brew-src": "brew-src"
-        "nix-darwin": "nix-darwin",
-        "nixpkgs": "nixpkgs_2"
       }
     }
   },

flake.nix

@@ -2,43 +2,21 @@
   description = "Homebrew installation manager for nix-darwin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nix-darwin.url = "github:LnL7/nix-darwin";
     brew-src = {
-      url = "github:Homebrew/brew/4.4.25";
+      url = "github:Homebrew/brew/6.0.12";
       flake = false;
     };
   };
 
-  outputs = { self, nixpkgs, nix-darwin, brew-src, ... } @ inputs: let
+  outputs = { self, brew-src }: let
-    # System types to support.
-    supportedSystems = [ "x86_64-darwin" "aarch64-darwin" ];
-
     flakeLock = builtins.fromJSON (builtins.readFile ./flake.lock);
     brewVersion = flakeLock.nodes.brew-src.original.ref;
 
-    forAllSystems =
+    ci = (import ./ci/flake-compat.nix).makeCi {
-      function:
+      inherit self brew-src;
-      nixpkgs.lib.genAttrs supportedSystems (
+    };
-        system: function nixpkgs.legacyPackages.${system}
-      );
   in {
-    packages = forAllSystems (pkgs: pkgs.callPackage ./pkgs {
+    darwinModules = rec {
-      inherit inputs;
-    });
-
-    devShell = forAllSystems (pkgs: pkgs.mkShell {
-      nativeBuildInputs = with pkgs; [
-      ];
-
-      BREW_SRC = brew-src;
-    });
-
-    ci = forAllSystems (pkgs: import ./ci (inputs // {
-      inherit pkgs;
-    }));
-
-    darwinModules = {
       nix-homebrew = { lib, ... }: {
         imports = [
           ./modules
@@ -48,6 +26,10 @@
           version = brewVersion;
         });
       };
+
+      default = nix-homebrew;
     };
+
+    inherit (ci) packages devShell ciTests githubActions;
   };
 }

modules/brew.tail.sh

@@ -6,13 +6,6 @@
 # nix-homebrew:
 # Run scripts/update-brew-tail.sh to update this
 
-# Use HOMEBREW_BREW_WRAPPER if set.
-export HOMEBREW_ORIGINAL_BREW_FILE="${HOMEBREW_BREW_FILE}"
-if [[ -n "${HOMEBREW_BREW_WRAPPER:-}" ]]
-then
-  HOMEBREW_BREW_FILE="${HOMEBREW_BREW_WRAPPER}"
-fi
-
 # These variables are exported in this file and are not allowed to be overridden by the user.
 BIN_BREW_EXPORTED_VARS=(
   HOMEBREW_BREW_FILE
@@ -22,6 +15,10 @@ BIN_BREW_EXPORTED_VARS=(
   HOMEBREW_USER_CONFIG_HOME
   HOMEBREW_ORIGINAL_BREW_FILE
 )
+BIN_BREW_EXPORTED_VARS_REGEX="^($(
+  IFS='|'
+  echo "${BIN_BREW_EXPORTED_VARS[*]}"
+))(=|$)"
 
 # Load Homebrew's variable configuration files from disk.
 export_homebrew_env_file() {
@@ -29,23 +26,28 @@ export_homebrew_env_file() {
 
   env_file="${1}"
   [[ -r "${env_file}" ]] || return 0
+
   while read -r line
   do
-    # only load HOMEBREW_* lines
+    # only load variables defined in env_config.rb
-    [[ "${line}" = "HOMEBREW_"* ]] || continue
+    [[ "${line}" =~ ^(HOMEBREW_|SUDO_ASKPASS=|(all|no|ftp|https?)_proxy=) ]] || continue
 
     # forbid overriding variables that are set in this file
-    local invalid_variable
+    [[ "${line}" =~ ${BIN_BREW_EXPORTED_VARS_REGEX} ]] && continue
-    for VAR in "${BIN_BREW_EXPORTED_VARS[@]}"
+
-    do
+    if [[ "${line}" == HOMEBREW_EXPERIMENTAL_RUST_FRONTEND=* ]]
-      [[ "${line}" = "${VAR}"* ]] && invalid_variable="${VAR}"
+    then
-    done
+      echo "Warning: Ignoring HOMEBREW_EXPERIMENTAL_RUST_FRONTEND. This cannot be set in an env file." >&2
-    [[ -n "${invalid_variable:-}" ]] && continue
+      continue
+    fi
 
     export "${line?}"
   done <"${env_file}"
 }
 
+# We only want to be able to set this in `brew.env` files.
+unset HOMEBREW_DISABLE_NO_FORCE_BREW_WRAPPER
+
 # First, load the system-wide configuration.
 export_homebrew_env_file "/etc/homebrew/brew.env"
 
@@ -62,6 +64,9 @@ export_homebrew_env_file "${HOMEBREW_PREFIX}/etc/homebrew/brew.env"
 if [[ -n "${XDG_CONFIG_HOME-}" ]]
 then
   HOMEBREW_USER_CONFIG_HOME="${XDG_CONFIG_HOME}/homebrew"
+elif [[ -n "${HOMEBREW_XDG_CONFIG_HOME-}" ]]
+then
+  HOMEBREW_USER_CONFIG_HOME="${HOMEBREW_XDG_CONFIG_HOME}/homebrew"
 else
   HOMEBREW_USER_CONFIG_HOME="${HOME}/.homebrew"
 fi
@@ -74,6 +79,13 @@ then
   export_homebrew_env_file "/etc/homebrew/brew.env"
 fi
 
+# Use HOMEBREW_FORCE_BREW_WRAPPER if set.
+export HOMEBREW_ORIGINAL_BREW_FILE="${HOMEBREW_BREW_FILE}"
+if [[ -n "${HOMEBREW_FORCE_BREW_WRAPPER:-}" ]]
+then
+  HOMEBREW_BREW_FILE="${HOMEBREW_FORCE_BREW_WRAPPER}"
+fi
+
 # Copy and export all HOMEBREW_* variables previously mentioned in
 # manpage or used elsewhere by Homebrew.
 
@@ -89,8 +101,8 @@ MANPAGE_VARS=(
 )
 for VAR in "${MANPAGE_VARS[@]}"
 do
-  # Skip if variable value is empty.
+  # Skip if variable value is empty or set to 0.
-  [[ -z "${!VAR:-}" ]] && continue
+  [[ -z "${!VAR:-}" || "${!VAR:-}" = "0" ]] && continue
 
   VAR_NEW="HOMEBREW_${VAR}"
   # Skip if existing HOMEBREW_* variable is set.
@@ -100,19 +112,29 @@ done
 
 # We don't want to take the user's value for, e.g., `HOMEBREW_PATH` here!
 USED_BY_HOMEBREW_VARS=(
+  CARGO_HOME
+  CARGO_INSTALL_ROOT
   CODESPACES
   COLORTERM
   DBUS_SESSION_BUS_ADDRESS
+  GOBIN
+  GOPATH
+  LANG
   NODENV_ROOT
   PATH
   PYENV_ROOT
   RBENV_ROOT
+  RUSTUP_HOME
   SSH_TTY
   SUDO_USER
   TMPDIR
   TMUX
+  VSCODE_IPC_HOOK_CLI
+  WSL_DISTRO_NAME
   XDG_CACHE_HOME
+  XDG_CONFIG_HOME
   XDG_DATA_DIRS
+  XDG_DATA_HOME
   XDG_RUNTIME_DIR
   ZDOTDIR
 )
@@ -155,6 +177,16 @@ then
   export HOMEBREW_GITHUB_HOSTED_RUNNER=1
 fi
 
+# don't filter the environment for `brew bundle (exec|env|sh)`
+if [[ "${1:-}" == "bundle" ]]
+then
+  if [[ "${2:-}" == "exec" || "${2:-}" == "env" || "${2:-}" == "sh" ]]
+  then
+    exec /bin/bash -p "${HOMEBREW_LIBRARY}/Homebrew/brew.sh" "$@"
+    exit $?
+  fi
+fi
+
 # filter the user environment
 PATH="@runtimePath@:/usr/bin:/bin:/usr/sbin:/sbin"
 

modules/default.nix

@@ -22,7 +22,7 @@
 # that automatically selects the correct prefix based on the architecture.
 # Use `arch -x86_64 brew` to install X86-64 packages.
 
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, options, ... }:
 let
   inherit (lib) types;
 
@@ -35,21 +35,21 @@ let
   tools = pkgs.callPackage ../pkgs { };
 
   brew = if cfg.patchBrew then patchBrew cfg.package else cfg.package;
-  ruby = pkgs.ruby_3_3;
+  ruby = pkgs.ruby_4_0;
 
   # Sadly, we cannot replace coreutils since the GNU implementations
   # behave differently.
-  runtimePath = lib.makeBinPath [ pkgs.git ];
+  runtimePath = lib.makeBinPath [ pkgs.gitMinimal ];
 
   prefixType = types.submodule ({ name, ... }: {
     options = {
       enable = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Whether to set up this Homebrew prefix.
         '';
       };
       prefix = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           The Homebrew prefix.
 
           By default, it's `/opt/homebrew` for Apple Silicon Macs and
@@ -59,7 +59,7 @@ let
         default = name;
       };
       library = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           The Homebrew library.
 
           By default, it's `/opt/homebrew/Library` for Apple Silicon Macs and
@@ -68,7 +68,7 @@ let
         type = types.str;
       };
       taps = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           A set of Nix-managed taps.
         '';
         type = types.attrsOf types.package;
@@ -132,13 +132,20 @@ let
     '' + (lib.optionalString (cfg.extraEnv != {})
             (lib.concatLines (lib.mapAttrsToList (name: value: "export ${name}=${lib.escapeShellArg value}") cfg.extraEnv)))
        + (builtins.readFile ./brew.tail.sh));
-  in pkgs.substituteAll {
+  in pkgs.replaceVarsWith {
     name = "brew";
     src = template;
     isExecutable = true;
 
-    inherit runtimePath;
+    # Must retain #!/bin/bash, otherwise `arch -x86_64 /usr/local/bin/brew`
-    inherit (prefix) prefix library;
+    # on Apple Silicon will not work.
+    dontPatchShebangs = true;
+
+    replacements = {
+      out = placeholder "out";
+      inherit runtimePath;
+      inherit (prefix) prefix library;
+    };
   };
 
   setupHomebrew = let
@@ -245,6 +252,19 @@ let
       exit 1
     fi
     /bin/ln -shf "${makeBinBrew prefix}" "$BIN_BREW"
+
+    ${setupTrust}
+  '';
+
+  setupTrust = let
+    trustEntries = flag: entries: lib.concatMapStrings (entry: ''
+      /usr/bin/sudo -n -u ${lib.escapeShellArg cfg.user} -H "$BIN_BREW" trust ${flag} ${lib.escapeShellArg entry} >/dev/null
+    '') entries;
+  in ''
+    ${trustEntries "--tap" cfg.trust.taps}
+    ${trustEntries "--formula" cfg.trust.formulae}
+    ${trustEntries "--cask" cfg.trust.casks}
+    ${trustEntries "--command" cfg.trust.commands}
   '';
 
   setupTaps = taps:
@@ -261,24 +281,31 @@ let
         error "$tty_underline${namespaceDir}$tty_reset is in the way and needs to be moved out for $tty_underline${path}$tty_reset"
         exit 1
       fi
-      if is_occupied "${tapDir}"; then
+      if [[ -L "${tapDir}" ]]; then
+        rm "${tapDir}"
+      elif [[ -d "${tapDir}" ]]; then
+        :
+        # directory
+      elif is_occupied "${tapDir}"; then
         error "An existing $tty_underline${tapDir}$tty_reset is in the way"
         exit 1
       fi
       "''${MKDIR[@]}" "${namespaceDir}"
       "''${CHOWN[@]}" "$NIX_HOMEBREW_UID:$NIX_HOMEBREW_GID" "${namespaceDir}"
       "''${CHMOD[@]}" "ug=rwx" "${namespaceDir}"
-      /bin/ln -shf "${target}" "${tapDir}"
+      /usr/bin/rsync -rL --delete "${target}/" "${tapDir}"
     '') (builtins.attrNames taps)
 
     # Fully declarative taps
     else let
-      env = pkgs.runCommandLocal "taps-env" {} (lib.concatMapStrings (path: let
+      env = pkgs.runCommandLocal "taps-env" { } (''
+        mkdir -p "$out"
+      '' + lib.concatMapStrings (path: let
         namespace = builtins.head (lib.splitString "/" path);
         target = taps.${path};
       in ''
         mkdir -p "$out/${namespace}"
-        ln -s "${target}" "$out/${path}"
+        cp -RH "${target}" "$out/${path}"
       '') (builtins.attrNames taps));
     in ''
       if is_occupied "$HOMEBREW_LIBRARY/Taps"; then
@@ -295,13 +322,20 @@ let
 
     # Disable self-update behavior
     substituteInPlace "$out/Library/Homebrew/cmd/update.sh" \
-      --replace 'for DIR in "''${HOMEBREW_REPOSITORY}"' "for DIR in "
+      --replace-fail 'for DIR in "''${HOMEBREW_REPOSITORY}"' "for DIR in "
 
     # Disable vendored Ruby
+    #
+    # Homebrew passes --disable=gems,rubyopt ($HOMEBREW_RUBY_DISABLE_OPTIONS)
+    # and inserts vendored libraries into LOAD_PATH (vendor/bundle/bundler/setup.rb, standalone/init.rb).
+    # Instead of re-enabling gems, we add in additional required gems into LOAD_PATH.
     ruby_sh="$out/Library/Homebrew/utils/ruby.sh"
-    if [[ -e "$ruby_sh" ]] && grep "setup-ruby-path" "$ruby_sh"; then
+    bundler_setup_rb="$out/Library/Homebrew/vendor/bundle/bundler/setup.rb"
-      chmod u+w "$ruby_sh"
+    if [[ -e "$ruby_sh" ]] && grep "setup-ruby-path" "$ruby_sh" >/dev/null; then
+      >&2 echo "Patching vendored Ruby..."
+      chmod u+w "$ruby_sh" "$bundler_setup_rb"
       echo -e "setup-ruby-path() { export HOMEBREW_RUBY_PATH=\"${ruby}/bin/ruby\"; }" >>"$ruby_sh"
+      echo -e "$:.unshift \"${ruby.gems.fiddle}/${ruby.gemPath}/gems/fiddle-${ruby.gems.fiddle.version}/lib\"" >>"$bundler_setup_rb"
     fi
   '' + lib.optionalString (brew ? version) ''
     # Embed version number instead of checking with git
@@ -316,7 +350,7 @@ in {
   options = {
     nix-homebrew = {
       enable = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Whether to install Homebrew.
         '';
         type = types.bool;
@@ -332,13 +366,13 @@ in {
         default = false;
       };
       package = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           The homebrew package itself.
         '';
         type = types.package;
       };
       taps = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           A set of Nix-managed taps.
 
           These are applied to the default prefixes.
@@ -357,7 +391,7 @@ in {
         '';
       };
       mutableTaps = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Whether to allow imperative management of taps.
 
           When enabled, taps can be managed via `brew tap` and
@@ -369,6 +403,68 @@ in {
         type = types.bool;
         default = true;
       };
+      trust = lib.mkOption {
+        description = ''
+          Tap trust entries to be added during activation.
+
+          Note: The trust entries are _not_ removed if you remove them from
+          those lists! Use the `brew untrust` command to remove a trust entry.
+
+          Refer to upstream documentations for more information:
+          <https://docs.brew.sh/Tap-Trust>
+        '';
+        type = types.submodule {
+          options = {
+            taps = lib.mkOption {
+              description = ''
+                Taps to trust in their entirety.
+
+                This should be used with caution. To quote upstream documentation:
+
+                > Trust a whole tap only when you are comfortable with all current and
+                > future formulae, casks and external commands from that tap being loaded
+                > by Homebrew.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo"
+              ];
+            };
+            formulae = lib.mkOption {
+              description = ''
+                Fully-qualified formulae to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/formula"
+              ];
+            };
+            casks = lib.mkOption {
+              description = ''
+                Fully-qualified casks to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/cask"
+              ];
+            };
+            commands = lib.mkOption {
+              description = ''
+                Fully-qualified external commands to trust.
+              '';
+              type = types.listOf types.str;
+              default = [];
+              example = [
+                "user/repo/command"
+              ];
+            };
+          };
+        };
+        default = {};
+      };
       autoMigrate = lib.mkOption {
         description = ''
           Whether to allow nix-homebrew to automatically migrate existing Homebrew installations.
@@ -380,13 +476,13 @@ in {
         default = false;
       };
       user = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           The user owning the Homebrew directories.
         '';
         type = types.str;
       };
       group = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           The group owning the Homebrew directories.
         '';
         type = types.str;
@@ -405,7 +501,7 @@ in {
         type = types.attrsOf prefixType;
       };
       defaultArm64Prefix = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Key of the default Homebrew prefix for ARM64 macOS.
         '';
         internal = true;
@@ -413,7 +509,7 @@ in {
         default = "/opt/homebrew";
       };
       defaultIntelPrefix = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Key of the default Homebrew prefix for Intel macOS or Rosetta 2.
         '';
         internal = true;
@@ -421,7 +517,7 @@ in {
         default = "/usr/local";
       };
       extraEnv = lib.mkOption {
-        description = lib.mdDoc ''
+        description = ''
           Extra environment variables to set for Homebrew.
         '';
         type = types.attrsOf types.str;
@@ -461,6 +557,12 @@ in {
         assertion = cfg.enableRosetta -> pkgs.stdenv.hostPlatform.isAarch64;
         message = "nix-homebrew.enableRosetta is set to true but this isn't an Apple Silicon Mac";
       }
+      {
+        # nix-darwin has migrated away from user activation in
+        # <https://github.com/LnL7/nix-darwin/pull/1341>.
+        assertion = options.system ? primaryUser;
+        message = "Please update your nix-darwin version to use system-wide activation";
+      }
     ];
 
     nix-homebrew = {
@@ -493,12 +595,14 @@ in {
 
     environment.systemPackages = [ brewLauncher ];
     system.activationScripts = {
-      # We set up a new system activation step that sets up Homebrew
+      # Set up the Homebrew prefixes before nix-darwin's homebrew
-      extraUserActivation.text = lib.mkAfter ''
+      # activation takes place.
+      homebrew.text = lib.mkBefore ''
         ${config.system.activationScripts.setup-homebrew.text}
       '';
       setup-homebrew.text = ''
-        sudo ${setupHomebrew}
+        >&2 echo "setting up Homebrew prefixes..."
+        ${setupHomebrew}
       '';
     };
 

pkgs/default.nix

@@ -1,6 +1,6 @@
-{ callPackage, inputs ? {} }:
+{ callPackage, brew-src ? null }:
 {
   nuke-homebrew-repository = callPackage ./nuke-homebrew-repository {
-    inherit inputs;
+    inherit brew-src;
   };
 }

pkgs/nuke-homebrew-repository/default.nix

@@ -1,6 +1,6 @@
 { lib
 , pkgs
-, substituteAll
+, replaceVarsWith
 , runtimeShell
 , coreutils
 , findutils
@@ -8,23 +8,25 @@
 , gnused
 , gitMinimal
 
-, inputs
+, brew-src ? null
 , runCommandLocal
 }:
 
 let
-  script = substituteAll {
+  script = replaceVarsWith {
     name = "nuke-homebrew-repository";
     src = ./nuke-homebrew-repository.sh.in;
     isExecutable = true;
 
-    inherit runtimeShell;
+    replacements = {
-    path = lib.makeBinPath [ coreutils findutils gnugrep gnused gitMinimal ];
+      inherit runtimeShell;
+      path = lib.makeBinPath [ coreutils findutils gnugrep gnused gitMinimal ];
+    };
   };
 
-  brew-src = inputs.brew-src or (throw "The tests can only be run with flakes");
+  test-nuke =
-
+    assert (lib.assertMsg (brew-src != null) "brew-src must be provided");
-  test-nuke = runCommandLocal "test-nuke" {
+  runCommandLocal "test-nuke" {
     nativeBuildInputs = [ gitMinimal ];
   } ''
     must_exist() {

pkgs/nuke-homebrew-repository/nuke-homebrew-repository.sh.in

@@ -30,7 +30,7 @@ if [[ ! -e ".git" ]]; then
   exit 1
 fi
 
-if ! grep -E "^# Homebrew" "README.md" >/dev/null; then
+if ! grep -E "^#.*Homebrew" "README.md" >/dev/null; then
   >&2 echo "${PWD} does not looks like a Homebrew checkout"
   exit 1
 fi