[bevanjkay]

• macOS 27 is now the latest stable release so, per docs/Acceptable-Casks.md, new casks needing Rosetta 2 are no longer acceptable. Error in audit_rosetta when a new cask's artifacts are x86_64-only.
• Drop the pre-Big Sur guards: Big Sur is the oldest allowed macOS. The depends_on macos: guard also skipped every cask without one, as nil&.maximum_version.to_s is "", which sorts before "11".

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude with Opus 5.5 at High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c8a2f75a-5434-48eb-9553-b62cdf9ba678

📥 Commits

Reviewing files that changed from the base of the PR and between a92c720 and ca73422.

📒 Files selected for processing: 2

• Library/Homebrew/cask/audit.rb
• Library/Homebrew/test/cask/audit_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • Updated cask auditing so new Rosetta 2-dependent casks are rejected.
  • Existing casks retain appropriate Rosetta and Intel-dependency validation.
  • Rosetta-requiring artefacts are now flagged when no macOS version requirement is specified.
  • Linux audits now complete without applying macOS-specific Rosetta validation.

• Documentation

  • Clarified that new Rosetta 2-dependent casks are no longer eligible under the latest macOS policy.

On ARM, audit_rosetta no longer checks the simulated macOS version or the cask’s maximum macOS dependency. New casks that require Rosetta 2 now fail the audit. Existing casks retain their caveat or Intel dependency check. Tests and policy documentation reflect these rules.

Changes: Rosetta audit policy

Layer / File(s)	Summary
Update Rosetta audit rules and coverage Library/Homebrew/cask/audit.rb, Library/Homebrew/test/cask/audit_spec.rb, docs/Acceptable-Casks.md	The ARM audit no longer checks the simulated macOS version or the cask’s maximum macOS dependency. New casks that require Rosetta 2 produce an audit error. Tests cover new casks, missing macOS dependencies, and Linux ARM audits. The eligibility documentation states that brew audit --new rejects new requires_rosetta casks.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to ca734

No concrete merge-blocking issue remains in the supplied evidence. The new-cask rejection is exercised by a focused test.

Security architecture risk: 🔵 Low · up to a92c7

The policy becomes stricter without granting new permissions. More ARM audits can now unpack downloaded software and install required unpacking tools. Those existing operations can leave partial host changes after failure, but no concrete new security vulnerability was established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The relevant exposure is the invoking audit environment: newly eligible ARM Rosetta checks can download and unpack cask content and install fixed unpacking dependencies. Restricted Rosetta-only audits demonstrate expanded reachability; ordinary full audits already have other callers of the same helper.

Trust Boundaries and Controls

• observed — Cask-provided download content reaches existing archive detection and extraction machinery. The changed branch adds an audit error after architecture inspection; it does not introduce a new identity, credential, or dependency-selection authority.

Resilience and Maintainability Implications

• observed — The preexisting helper caches completed extraction and registers temporary-directory cleanup through a finalizer. Dependency installation and extraction have no transactional rollback in this helper; exceptions are caught by the outer audit dispatcher and stop subsequent dispatch. The PR broadens reachability of these behaviors but does not change their implementation or establish concurrent use of one Audit instance.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely states the main change: rejecting new casks that require Rosetta.
Description check		The description explains the Rosetta audit change, the macOS guard removal, the affected bug, tests, and validation performed.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9e1db610-904a-4918-8ec1-38667f5a67c5

📥 Commits

Reviewing files that changed from the base of the PR and between 3e90673 and a92c720.

📒 Files selected for processing: 3

• Library/Homebrew/cask/audit.rb
• Library/Homebrew/test/cask/audit_spec.rb
• docs/Acceptable-Casks.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[MikeMcQuaid]

Thanks!

[MikeMcQuaid]

Thanks!