Extend sandboxing to package processing by MikeMcQuaid · Pull Request #24038 · Homebrew/brew

MikeMcQuaid · 2026-09-19T21:33:11Z

Limit downloaded package operations to intended output paths and share sandbox setup with build, test and installation workers.
Mount disk images read-only in the parent and sandbox extraction at each stage, without trusting archive-created symlinks for new grants.
Load disk-image filtering helpers in workers and capture setup warnings without assuming standard error is a file.
Preserve sandbox workers' private temporary directories in tests and keep formula fixtures independent of implicit host dependencies.
Allow padded prefixes inside the repository while protecting its code.
Use the public Keg interface for sandboxed install linkage repairs.
Preserve required download authentication, validate trust boundaries and warn when package processing proceeds without a sandbox.
Explain sandboxing principles and limitations in the security guide.

Have you followed our Contributing guidelines?
Have you checked for other open Pull Requests for the same change?
Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
Have you explained why you'd like these changes included, not just what they do?
For bug fixes, have you given step-by-step brew commands to reproduce the bug?
Have you written new tests (excluding integration tests)? Here's an example.
Have you successfully run brew lgtm (style, typechecking and tests) locally?

I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot · 2026-09-19T21:39:18Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Run {

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

andrew

A couple of smaller things in addition to the open comments.

- Limit downloaded package operations to intended output paths and share sandbox setup with build, test and installation workers. - Pass sandbox inheritance through a read-only descriptor so environment flags and ordinary file permissions cannot establish confinement. - Retain write-protection checks when permissions allow a useful probe and reuse inherited Homebrew sandboxes quietly. - Share VCS sandbox setup and fetch-only credential checks while keeping transport-specific permissions in each download strategy. - Follow trusted global Git includes and custom credential stores without allowing repository-local configuration to grant home access. - Resolve relative Git credentials from the clone or fetch directory and preserve the caller's `HOME` for CVS without requiring `USER` or a passwd entry when `HOME` is set. - Mount disk images read-only in the parent and sandbox extraction at each stage, without trusting archive-created symlinks for new grants. - Load disk-image filtering helpers in workers and capture setup warnings without assuming standard error is a file. - Forward Ctrl-C to captured process groups to interrupt helpers that have closed their output pipes. - Preserve sandbox workers' private temporary directories in tests and keep formula fixtures independent of implicit host dependencies. - Allow padded prefixes inside the repository while protecting its code. - Use the public `Keg` interface for sandboxed install linkage repairs. - Preserve required download authentication, validate trust boundaries and warn when package processing proceeds without a sandbox. - Redact proxy credentials from diagnostics and serialised errors while preserving the environment passed to package metadata inspection. - Check expected bottle warnings and reject unexpected stderr output. - Explain sandboxing principles and vendor installer trust in the guide.

Comments addressed

MikeMcQuaid requested a review from a team as a code owner September 19, 2026 21:33

Copilot AI lite review requested due to automatic review settings September 19, 2026 21:33

Copilot started reviewing on behalf of MikeMcQuaid September 19, 2026 21:33

View session

Copilot AI reviewed Sep 19, 2026

MikeMcQuaid force-pushed the sandbox-package-processing branch 6 times, most recently from fd95e6f to 81c534e Compare September 20, 2026 15:02