[ttsuru]

What

Allowlist JPKI*.dylib in the stray dylib diagnostic.

Ref: Homebrew/homebrew-cask#289430

Why

JPKI User Client Software (公的個人認証サービス 利用者クライアントソフト) is the official client for the certificates on Japan's national ID card (My Number Card). The National Tax Agency's e-Tax setup guide for Mac lists it as a required install for filing tax returns with the card.

Its installer places these PKCS#11 modules in /usr/local/lib:

• JPKIPKCS11.dylib
• JPKIPKCS11Auth.dylib
• JPKIPKCS11Sign.dylib
• JPKIServiceAPI.dylib

The installer's preinstall script also writes /etc/e-gov_app/load_path/default.dat, which points other e-government applications at /usr/local/lib/JPKIPKCS11Sign.dylib and /usr/local/lib/JPKIPKCS11Auth.dylib, so the files cannot be moved elsewhere.

The jpki cask was added to homebrew/cask in Homebrew/homebrew-cask#289430, so every install of it currently makes brew doctor warn about these files. They were verified as:

• Package: jp.go.jpki version 3.9
• Installer signature: Developer ID Installer: Japan Agency for Local Authority Information Systems (LQF3UNS9HK), notarised
• Architectures: arm64 and x86_64

This follows the existing vendor entries in check_for_stray_dylibs. A glob is used, as for sentinel-*.dylib, because all four files share the JPKI prefix.

Reproduction

brew install --cask jpki
brew doctor

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/JPKIPKCS11.dylib
  /usr/local/lib/JPKIPKCS11Auth.dylib
  /usr/local/lib/JPKIPKCS11Sign.dylib
  /usr/local/lib/JPKIServiceAPI.dylib

Verification

• With this change, check_for_stray_dylibs returns no finding on my Mac with the cask installed.
• brew lgtm --online passes.
• No new test was added because this only extends the existing static allowlist.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

AI/LLM disclosure: I used Claude Code (Anthropic, models claude-fable-5-1 and claude-opus-5-5) to inspect the installer's scripts and binaries, locate the existing allowlist, make this one-line change, run brew lgtm and draft this description. I reviewed the diff and verified the result on my Mac (Apple Silicon, macOS 27).

---

[Copilot]

Copilot review overview

🟢 Approval recommended

The reviewed allowlist change is focused and has no unresolved issues.

Review effort: Lite
Findings: None

What changed in this PR

Allows official JPKI client dylibs to be excluded from stray dylib diagnostics.

Changes:

• Adds a JPKI*.dylib allowlist entry.

File	Description
Library/​Homebrew/​diagnostic.rb	Allows JPKI client dylibs in stray dylib diagnostics.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[MikeMcQuaid]

Thanks!

[ttsuru]

@MikeMcQuaid Thanks for review!