[MikeMcQuaid]

• Use the effective GID when AD/mobile group records are unavailable.
• Avoid granting group writes to staff or unresolved Caskroom groups.

Fixes #24140

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6.1 Sol at Extra High effort, with local review and testing.

---

[Copilot]

Copilot review overview

🟡 Changes recommended

The application spec has unresolved Linux expectations and cache-reset issues.

Review effort: Lite
Findings: 1

Open (1)

• Restrict unresolved GID expectation to macOS · New

What changed in this PR

Updates Caskroom group handling for unresolved effective GIDs and prevents unsafe group-write permissions.

Changes:

• Adds numeric GID fallback and ownership checks.
• Restricts permissions for unresolved or shared groups.
• Adds regression coverage.

File	Summary
Library/​Homebrew/​test/​cask/​caskroom_spec.rb	Tests unresolved and numeric group handling.
Library/​Homebrew/​test/​cask/​artifact/​app_spec.rb	Adds unresolved-GID coverage; requires cache reset and platform-specific expectations.
Library/​Homebrew/​cask/​caskroom.rb	Implements numeric GID fallback and safe permission handling.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.