Skip to content

Add warning for formula installation from forbidden paths#20444

Merged
MikeMcQuaid merged 1 commit intomainfrom
copilot/fix-20441
Aug 13, 2025
Merged

Add warning for formula installation from forbidden paths#20444
MikeMcQuaid merged 1 commit intomainfrom
copilot/fix-20441

Conversation

Copy link
Contributor

Copilot AI commented Aug 13, 2025 •
edited by MikeMcQuaid
Loading

When HOMEBREW_FORBID_PACKAGES_FROM_PATHS is enabled and users try to install a formula from a local file path outside of allowed directories, they now receive a helpful warning message instead of silent failure.

No formula file found at /path/to/formula.rb. 
To install a custom formula: (1) Use `brew create <URL>` to create a formula from a URL, 
(2) Use `brew tap-new <user>/<repo>` to create a custom tap. 
See: https://docs.brew.sh/Formula-Cookbook

Changes

  • Enhanced path validation: Modified FromPathLoader.try_new to output a warning using opoo when forbid_packages_from_paths is enabled and the path exists but is outside allowed directories
  • Improved efficiency: Store path.realpath in a variable to avoid multiple calls
  • Clear guidance: Warning message provides actionable alternatives like brew create and brew tap-new without referencing developer mode

Implementation Details

  • Warning is only shown when the path actually exists but is forbidden (not for non-existent paths)
  • Maintains existing security restrictions while providing better user feedback
  • Normal formula installation and existing functionality remain completely unaffected

Testing

Added unit test in formulary_spec.rb to verify the warning is properly displayed when accessing forbidden paths.

Fixes #20441.
Fixes #20448

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

Copilot AI changed the title [WIP] Improve error when preventing install formula from local file Improve error message when installing formula from non-existent local file Aug 13, 2025
Copilot AI requested a review from MikeMcQuaid August 13, 2025 13:48
MikeMcQuaid
MikeMcQuaid reviewed Aug 13, 2025
View reviewed changes
Copy link
Contributor Author

Copilot AI commented Aug 13, 2025

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

  • eu-central-1-1.aws.cloud2.influxdata.com
    • Triggering command: /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/4.6.3-42-g7b6cba3 (Linux; x86_64 Ubuntu 24.04.2 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 --header Accept: application/json --data-binary command_run,command=style,ci=true,devcmdrun=true,developer=false options=&#34;--fix&#34; 1755096192 --silent --output /dev/null REDACTED (dns block)
    • Triggering command: /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/4.6.3-42-g7b6cba3 (Linux; x86_64 Ubuntu 24.04.2 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 --header Accept: application/json --data-binary command_run,command=style,ci=true,devcmdrun=true,developer=false options=&#34;--fix&#34; 1755096211 --silent --output /dev/null REDACTED (dns block)
    • Triggering command: /bin/curl --disable --cookie /dev/null --globoff --user-agent Linuxbrew/4.6.3-42-g7b6cba3 (Linux; x86_64 Ubuntu 24.04.2 LTS) curl/8.5.0 --header Accept-Language: en --fail --progress-bar --retry 3 --max-time 3 --header Authorization: Token iVdsgJ_OjvTYGAA79gOfWlA_fX0QCuj4eYUNdb-qVUTrC3tp3JTWCADVNE9HxV0kp2ZjIK9tuthy_teX4szr9A== --header Content-Type: text/plain; charset=utf-8 --header Accept: application/json --data-binary command_run,command=tests,ci=true,devcmdrun=true,developer=false options=&#34;--only=&#34; 1755096240 --silent --output /dev/null REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title Improve error message when installing formula from non-existent local file Add warning for formula installation from forbidden paths Aug 13, 2025
Copilot AI requested a review from MikeMcQuaid August 13, 2025 14:46
@MikeMcQuaid MikeMcQuaid force-pushed the copilot/fix-20441 branch 2 times, most recently from 2c49a04 to 27d52b1 Compare August 13, 2025 16:10
@MikeMcQuaid MikeMcQuaid mentioned this pull request Aug 13, 2025
Closed
1 task
@MikeMcQuaid
Improve error message for local formula file installation attempts
cfa7326 
Co-authored-by: MikeMcQuaid <125011+MikeMcQuaid@users.noreply.github.com>
@MikeMcQuaid MikeMcQuaid linked an issue Aug 13, 2025 that may be closed by this pull request
[Regression] Installation fails for local formula with the setup-homebrew action #20448
Closed
3 tasks
@MikeMcQuaid MikeMcQuaid mentioned this pull request Aug 13, 2025
Closed
3 tasks
@MikeMcQuaid MikeMcQuaid marked this pull request as ready for review August 13, 2025 16:40
@MikeMcQuaid MikeMcQuaid added this pull request to the merge queue Aug 13, 2025
Merged via the queue into main with commit 56b85a1 Aug 13, 2025
36 checks passed
@MikeMcQuaid MikeMcQuaid deleted the copilot/fix-20441 branch August 13, 2025 18:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@p-linnane p-linnane p-linnane approved these changes

+1 more reviewer

@MikeMcQuaid MikeMcQuaid MikeMcQuaid approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@MikeMcQuaid MikeMcQuaid

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Regression] Installation fails for local formula with the setup-homebrew action Improve error when preventing install formula from local file

3 participants

@MikeMcQuaid @p-linnane