Homebrew: Bottle Security and Cask Migrations
Homebrew is hardening bottle supply-chain security with pinned manifests and Sigstore verification, while fixing tap migrations that left casks stuck. A parallel cleanup enables gradual lint quality limits and resolves dozens of tech-debt sites.
Duration: PT2M40S
Episode overview
This episode is a short developer briefing from Homebrew.
It explains recent repository work in plain language.
- Show: Homebrew
- Published: 2026-11-14T14:12:04Z
- Audio duration: PT2M40S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Hello, and welcome to Homebrew for Friday, November 14th, 2026.
The headline is trust: Homebrew is hardening how bottles are fetched and verified, while fixing a cluster of tap migration bugs that left casks stuck.
First, supply chain security. Merged plan in PR 24598 says bottle attestation today needs the GitHub command line, a token, and a slow, rate-limited API, so it cannot be on by default. The fix is to carry verification material inside each bottle's own platform manifest and fetch that manifest alone by content…
Second, cask moves. PR 24583 updates install receipts so casks follow their new tap and checks trust for the target. PR 24600 extends that to Git redirect renames, where today casks silently never show as outdated until reinstalled. PR 24595 cleans up the counting, combining history with official tap metadata and…
Third, codebase health. PRs 24587 and 24596 turn on gradual lint quality limits, resolving 47 cleanup sites while keeping broader refactors visible, with 24602 tackling the remainder. Two reliability fixes also landed: sandbox extraction from external caches in 24580 for restricted Mac workers, and autoremove safety…
What's next: expect the 21-part Sigstore…
Nearby episodes from Homebrew
- Upgrade Edge Cases and Lint Limits
- Info Unification and Cask Reliability Push
- Fixing False Upgrade Blocks and Cutting Overhead
- Type Safety Push and API-First Cask CI
- Safer Uninstalls and Type Safety Push
- Weekly Recap - Safer Uninstalls and Stricter Typing
- Correct Reinstalls and Safer Uninstalls
- Legacy Keg Safety and Lint Cleanup