brew: check installed apps against their pins after self-update

Aperta
  • Qualcosa non va?
#66 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
58/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
macos, shell
Ambito
cli, tooling

Direzione di ricerca

This depends on #65, which provides the pins and verify-casks --installed; read that issue and inspect the existing dotfiles doctor command entry point. Start by running the installed-cask check and trace how its results can be reported. Done when one command reports each installed cask's signer state, stays silent on success unless asked, and fails when a pin is changed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Brew installs an app once. After that, the app updates itself. Ten of
the thirteen desktop casks set auto_updates. Their updaters deliver
all later code. Brew does not see it.

The pins from #65 still apply. An update signed by a different team is
the event to catch.

Do

Run verify-casks --installed on a schedule. Two choices:

  • A launchd agent, daily. It writes failures to a log and posts a
    notification.
  • A dotfiles doctor subcommand, run by hand.

Start with the subcommand. Add the agent if the subcommand is forgotten.

Output

One line per app. Say nothing on success unless asked.

FAIL signer: /Applications/Slack.app is not signed by BQR82RBBHL
FAIL gatekeeper: /Applications/eul.app is not notarized
UNPINNED tolaria

Not in scope

The check does not stop a bad update. It finds one after the fact. To
stop updates, disable the updater. That trades a rare risk for a
constant one: browsers and password managers then wait for a manual
bump. Do not do that.

Done when

  • One command reports the signer state of every installed cask.
  • Changing a pin by one character makes that command fail.

Depends on #65.

Lingua principale
Shell
Stelle
1
Fork
0
Merge medio
9h 5m
PR unite (30g)
5

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di indexzero/dotfiles

Tutte le issue di indexzero/dotfiles

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.