Homebrew casks for Affinidi command-line tools.
# macOS and Linux
brew install --cask affinidi-ai/tap/boris
brew upgrade --cask affinidi-ai/tap/borisAlways use the fully qualified name: Homebrew then trusts this one item from
this tap, with no prompt. A bare name (brew upgrade boris) only loads items
of a tap you trust: brew trust affinidi-ai/tap once, if you want that.
Casks/boris.rb installs the boris command-line client on macOS (12 or
later, Apple silicon and Intel) and on Linux (arm64 and x86_64, a static musl
binary). On macOS the binary is Developer ID signed and notarized, so the
cask has no postflight and never removes the quarantine attribute:
Gatekeeper's check of the download is real.
Nobody edits Casks/boris.rb by hand. The boris release pipeline (the
cli:publish:tap job of a cli-v<x.y.z> tag in boris-md) renders it from
the signed release and opens a pull request here on a branch
boris-<x.y.z>. It never pushes to main. A CODEOWNER merges it; until
then brew keeps installing the previous version.
The pipeline authenticates with a GitHub App installed on this repository
only (contents and pull requests). main is protected, and the App is not on
its bypass list, so the App alone cannot change what brew installs.
Before approving, check that:
- the title and
versionare thecli-v<x.y.z>tag that was released, and the boris-md pipeline for that tag passedcli:release:check; urlishttps://<release host>/boris/v#{version}/boris-#{version}-#{arch}-#{os}.tar.gz, the immutable versioned path, on the release host boris-md commits inclients/boris-cli/release-host(osisapple-darwinorunknown-linux-musl);- all four
sha256values (arm,intel,arm64_linux,x86_64_linux) match the release'sSHA256SUMS(whose signatureSHA256SUMS.sigverifies with boris-md'sclients/boris-cli/release-key.pub); - the cask has no
preflight,postflight,system_command,xattror quarantine handling, and its macOS requirement is insideon_macos; - the
cask(macOS) andcask-linuxchecks on the pull request passed.
Open a pull request putting Casks/boris.rb back to the previous version
and merge it after review. Released archives are never deleted, so the previous
URL and hashes still resolve.
Casks/fabric.rb installs fabric, the Affinidi Trust Fabric command-line
client (macOS 12 or later, Apple silicon and Intel). The binary is Developer
ID signed and notarized, so the cask has no postflight and never removes the
quarantine attribute.
brew install --cask affinidi-ai/tap/fabric
brew upgrade --cask affinidi-ai/tap/fabricHomebrew also has an unrelated fabric formula, so the fully qualified name
matters here.
Nobody edits Casks/fabric.rb by hand. Once the release workflow of a
v<x.y.z> tag passes in affinidi-ai/affinidi-trust-fabric-cli, its
homebrew-tap workflow renders the cask from the release's SHA256SUMS and
opens a pull request here on a branch fabric-<x.y.z>, titled
chore(cask): fabric <x.y.z>. It never pushes to main. A CODEOWNER from
@affinidi-ai/affinidi-fabric-cli-codeowners merges it; until then brew
keeps installing the previous version.
The workflow authenticates with the CLI release bot GitHub App, using a token
limited to this repository's contents and pull requests. The App is on the
bypass list of main's ruleset, as on every repository it releases, so the
workflow only ever writes to its fabric-<x.y.z> branch and opening a pull
request is the last thing it does.
Before approving, check that:
- the title and
versionare<x.y.z>, from thev<x.y.z>tag that was released, and the CLI'sreleaseworkflow for that tag passed; urlishttps://github.com/affinidi-ai/affinidi-trust-fabric-cli/releases/download/v#{version}/fabric-#{version}-#{arch}-apple-darwin.tar.gz, the versioned release archive;- both
sha256values match the release'sSHA256SUMS; - the cask has no
preflight,postflight,system_command,xattror quarantine handling; - the
caskcheck on the pull request passed.
First make the previous release GitHub's latest again, for example
gh release edit v<previous> --latest -R affinidi-ai/affinidi-trust-fabric-cli,
or mark the bad release as a pre-release. The cask's livecheck reads GitHub's
latest release, so until then the cask check's audit fails for the older
version. Then open a pull request
putting Casks/fabric.rb back to the previous version and merge it after
review. The previous release's archives stay on its GitHub Release, so the
previous URL and hashes still resolve.