Stop publishing a Homebrew formula

.github/workflows/build-macos-pkg.yml

@@ -0,0 +1,54 @@
+name: Build Firewall.pkg
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+jobs:
+  pkg:
+    runs-on: macos-26
+    env:
+      TEAM: ${{ vars.APPLE_TEAM }}
+      NOTARY_PROFILE: firewall
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - run: brew install xcodegen
+      - name: Install signing identities, profiles and notary key
+        env:
+          CERTIFICATES: ${{ secrets.MACOS_CERTIFICATES }}
+          CERTIFICATES_PASSWORD: ${{ secrets.MACOS_CERTIFICATES_PASSWORD }}
+          APP_PROFILE: ${{ secrets.MACOS_APP_PROFILE }}
+          EXTENSION_PROFILE: ${{ secrets.MACOS_EXTENSION_PROFILE }}
+          NOTARY_KEY: ${{ secrets.NOTARY_KEY }}
+          NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }}
+          NOTARY_ISSUER: ${{ secrets.NOTARY_ISSUER }}
+        run: |
+          keychain="$RUNNER_TEMP/signing.keychain-db"
+          security create-keychain -p "" "$keychain"
+          security set-keychain-settings "$keychain"
+          security unlock-keychain -p "" "$keychain"
+          security default-keychain -s "$keychain"
+          security list-keychains -d user -s "$keychain" login.keychain
+          base64 --decode <<<"$CERTIFICATES" > "$RUNNER_TEMP/certificates.p12"
+          security import "$RUNNER_TEMP/certificates.p12" -k "$keychain" -P "$CERTIFICATES_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/pkgbuild
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$keychain" >/dev/null
+
+          profiles="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
+          mkdir -p "$profiles"
+          base64 --decode <<<"$APP_PROFILE" > "$profiles/app.provisionprofile"
+          base64 --decode <<<"$EXTENSION_PROFILE" > "$profiles/extension.provisionprofile"
+
+          printf '%s' "$NOTARY_KEY" > "$RUNNER_TEMP/notary.p8"
+          xcrun notarytool store-credentials "$NOTARY_PROFILE" \
+            --key "$RUNNER_TEMP/notary.p8" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"
+      - run: macos/build.sh
+      - uses: actions/upload-artifact@v7
+        with:
+          name: artifacts-macos-pkg
+          path: macos/build/Firewall.pkg

.github/workflows/release.yml

@@ -211,14 +211,24 @@ jobs:
           path: |
             ${{ steps.cargo-dist.outputs.paths }}
             ${{ env.BUILD_MANIFEST_NAME }}
+
+  custom-build-macos-pkg:
+    needs:
+      - plan
+      - build-local-artifacts
+    uses: ./.github/workflows/build-macos-pkg.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
   # Determines if we should publish/announce
   host:
     needs:
       - plan
       - build-local-artifacts
       - build-global-artifacts
+      - custom-build-macos-pkg
     # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-macos-pkg.result == 'skipped' || needs.custom-build-macos-pkg.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: "ubuntu-22.04"
@@ -278,52 +288,6 @@ jobs:
 
           gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
-  publish-homebrew-formula:
-    needs:
-      - plan
-      - host
-    runs-on: "ubuntu-22.04"
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PLAN: ${{ needs.plan.outputs.val }}
-      GITHUB_USER: "axo bot"
-      GITHUB_EMAIL: "[email protected]"
-    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: true
-          repository: "usestrix/homebrew-tap"
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-      # So we have access to the formula
-      - name: Fetch homebrew formulae
-        uses: actions/download-artifact@v8
-        with:
-          pattern: artifacts-*
-          path: Formula/
-          merge-multiple: true
-      # This is extra complex because you can make your Formula name not match your app name
-      # so we need to find releases with a *.rb file, and publish with that filename.
-      - name: Commit formula files
-        run: |
-          git config --global user.name "${GITHUB_USER}"
-          git config --global user.email "${GITHUB_EMAIL}"
-
-          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith(".rb")] | any)'); do
-            filename=$(echo "$release" | jq '.artifacts[] | select(endswith(".rb"))' --raw-output)
-            name=$(echo "$filename" | sed "s/\.rb$//")
-            version=$(echo "$release" | jq .app_version --raw-output)
-
-            export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"
-            brew update
-            # We avoid reformatting user-provided data such as the app description and homepage.
-            brew style --except-cops FormulaAudit/Homepage,FormulaAudit/Desc,FormulaAuditStrict --fix "Formula/${filename}" || true
-
-            git add "Formula/${filename}"
-            git commit -m "${name} ${version}"
-          done
-          git push
-
   custom-publish-crates:
     needs:
       - plan
@@ -342,12 +306,11 @@ jobs:
     needs:
       - plan
       - host
-      - publish-homebrew-formula
       - custom-publish-crates
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

core/src/aliasing/managers/bun.rs

@@ -11,5 +11,4 @@ pub static BUN: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/cargo.rs

@@ -17,5 +17,4 @@ pub static CARGO: Manager = Manager {
             "source.firewall.registry=\"sparse+http://index.crates.io/\"",
         ],
     }],
-    lockfile: None,
 };

core/src/aliasing/managers/gem.rs

@@ -8,5 +8,4 @@ pub static GEM: Manager = Manager {
         when: &["install", "update", "fetch"],
         flags: &["--clear-sources", "--source", "http://rubygems.org/"],
     }],
-    lockfile: None,
 };

core/src/aliasing/managers/go.rs

@@ -11,5 +11,4 @@ pub static GO: Manager = Manager {
         ("GOFLAGS", "-mod=mod"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/mod.rs

@@ -36,14 +36,6 @@ pub struct Manager {
     pub command: &'static str,
     pub env: &'static [(&'static str, &'static str)],
     pub args: &'static [Args],
-    /// Where the manager records registry URLs, which then carry our http:// override.
-    pub lockfile: Option<Lockfile>,
-}
-
-/// What to do after a run about http:// registry URLs left in the lockfile at this path.
-pub enum Lockfile {
-    Restore(&'static str),
-    Warn(&'static str),
 }
 
 pub static MANAGERS: &[&Manager] =

core/src/aliasing/managers/npm.rs

@@ -1,4 +1,4 @@
-use super::{Lockfile, Manager, PROXY};
+use super::{Manager, PROXY};
 
 pub static NPM: Manager = Manager {
     command: "npm",
@@ -8,5 +8,4 @@ pub static NPM: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: Some(Lockfile::Restore("package-lock.json")),
 };

core/src/aliasing/managers/pdm.rs

@@ -13,5 +13,4 @@ pub static PDM: Manager = Manager {
         ("PDM_PYPI_VERIFY_SSL", "false"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/pip.rs

@@ -12,5 +12,5 @@ pub static PIP: Manager = recipe("pip");
 pub static PIP3: Manager = recipe("pip3");
 
 const fn recipe(name: &'static str) -> Manager {
-    Manager { command: name, env: PIP_ENV, args: &[], lockfile: None }
+    Manager { command: name, env: PIP_ENV, args: &[] }
 }

core/src/aliasing/managers/pipenv.rs

@@ -13,5 +13,4 @@ pub static PIPENV: Manager = Manager {
         ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/pnpm.rs

@@ -9,5 +9,4 @@ pub static PNPM: Manager = Manager {
         ("pnpm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/uv.rs

@@ -1,8 +1,7 @@
-use super::{Lockfile, Manager, PROXY, PYPI_SIMPLE};
+use super::{Manager, PROXY, PYPI_SIMPLE};
 
 pub static UV: Manager = Manager {
     command: "uv",
     env: &[("HTTP_PROXY", PROXY), ("http_proxy", PROXY), ("UV_DEFAULT_INDEX", PYPI_SIMPLE)],
     args: &[],
-    lockfile: Some(Lockfile::Warn("uv.lock")),
 };

core/src/aliasing/mod.rs

@@ -6,11 +6,9 @@ mod windows;
 pub use forward::spawn;
 pub use managers::*;
 
-use crate::policies::registries::BUILT_IN;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 use std::process::Command;
-use tracing::{info, warn};
 
 pub struct Invocation {
     pub program: String,
@@ -52,42 +50,10 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     let status = command.status();
     #[cfg(windows)]
     let status = status.map_err(|error| windows::explain(error, &program));
-    let code = status?.code().unwrap_or(1);
-    let manager = MANAGERS.iter().find(|manager| manager.command == invocation.program);
-    match manager.and_then(|manager| manager.lockfile.as_ref()) {
-        Some(Lockfile::Restore(lockfile)) => restore_https(lockfile, dir),
-        Some(Lockfile::Warn(lockfile)) => warn_if_plaintext(lockfile, dir),
-        None => {}
-    }
-    Ok(code)
+    Ok(status?.code().unwrap_or(1))
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.
 fn resolve(program: &str) -> std::io::Result<PathBuf> {
     which::which(program).map_err(|e| Error::new(ErrorKind::NotFound, e))
 }
-
-fn warn_if_plaintext(lockfile: &str, dir: Option<&Path>) {
-    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
-    let Ok(text) = std::fs::read_to_string(path) else { return };
-    if BUILT_IN.iter().any(|registry| text.contains(&format!("http://{}/", registry.host()))) {
-        warn!("{lockfile} has http:// registry URLs; change them to https:// before committing");
-    }
-}
-
-fn restore_https(lockfile: &str, dir: Option<&Path>) {
-    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
-    let Ok(text) = std::fs::read_to_string(&path) else { return };
-    let mut fixed = text.clone();
-    for registry in BUILT_IN {
-        let host = registry.host();
-        fixed = fixed.replace(&format!("http://{host}/"), &format!("https://{host}/"));
-    }
-    if fixed == text {
-        return;
-    }
-    match std::fs::write(&path, fixed) {
-        Ok(()) => info!("changed {lockfile}'s registry URLs back to https://"),
-        Err(e) => warn!("could not change {lockfile}'s registry URLs back to https://: {e}"),
-    }
-}

dist-workspace.toml

@@ -4,10 +4,10 @@ members = ["cargo:core"]
 [dist]
 cargo-dist-version = "0.32.0"
 ci = "github"
-installers = ["shell", "powershell", "homebrew", "msi"]
+installers = ["shell", "powershell", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
 features = ["machine-wide"]
-tap = "usestrix/homebrew-tap"
-publish-jobs = ["homebrew", "./publish-crates"]
+publish-jobs = ["./publish-crates"]
+global-artifacts-jobs = ["./build-macos-pkg"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]