[hezhizhen]

Summary

Legacy :all bottles with backfilled attestations are rejected because the ordinary :all filename matcher ignores the URL-prefixed subject. Use exact subject matching for the backfill repository, including the URL hash, while keeping the digest and cutoff-date checks.

- if bottle.tag.to_sym == :all
+ if bottle.tag.to_sym == :all && signing_repo != BACKFILL_REPO

Evidence

Deterministic reproduction using the added regression fixtures:

1. Apply only the test additions to upstream f6051a7a57.

2. Run:

   ./bin/brew tests --only=attestation:741,attestation:746,attestation:754,attestation:765

   Before: 4 examples, 2 failures. The valid URL-prefixed subject is rejected and a subject without the URL hash is accepted.

3. Apply the production condition change and run the same command.

   After: 4 examples, 0 failures. Different URLs and digests remain rejected.

./bin/brew lgtm --online passes typechecking, style and all 61 attestation examples. The fixtures mock gh responses; they do not fetch or verify a real remote signature. The historical backfill list includes all bottles.

Merge Danger

Door: Two-way; a one-line condition change with regression coverage.

Blast Radius: Limited

Backfilled :all bottles use the exact URL-prefixed subject. Existing tests cover ordinary :all filename matching and backfill timestamp rejection.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

---

AI assistance: OpenAI Codex was used for diagnosis, implementation and regression tests. Local checks are complete.

[MikeMcQuaid]

Can you explain why this fix and what error you're seeing where/when from a brew command without it?

[hezhizhen]

Can you explain why this fix and what error you're seeing where/when from a brew command without it?

There is now a concrete reproduction with cadubi--1.3.4.all.bottle.tar.gz, which the current cadubi formula still distributes.

With an authenticated gh, run:

./bin/brew verify cadubi --bottle-tag=all

Before the change (f6051a7a57), verification retries and exits with status 1:

no attestation matches subject: 5793baa529e94269217b83643f3df45cf96b2bc33ed7b661903f197e9872730c--cadubi--1.3.4.all.bottle.tar.gz

After the change (ee46e78c6f), it exits with status 0:

==> cadubi--1.3.4.all.bottle.tar.gz has a valid attestation

Both runs used isolated checkouts and caches, the same current official formula and bottle, and live gh attestation verification.

This bottle has a valid backfilled attestation whose subject contains the URL hash before the filename. The existing :all branch ignores the supplied expected subject and instead matches an unprefixed bottle filename, so it rejects this valid attestation.

The change makes backfilled :all bottles use the existing exact subject comparison. Ordinary :all matching, digest validation and the backfill cutoff check remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Backfilled bottles tagged for all platforms now require an exact match between the attestation subject and bottle details.
  • Added checks to ensure mismatched bottle URLs, digests or digest prefixes are rejected, while valid backfilled attestations are accepted.

For :all bottles, backfill attestations now use exact subject matching instead of the formula-name/version pattern. Tests cover accepted URL-prefixed subjects and rejection cases.

Changes: Backfill Attestation Subject Matching

Layer / File(s)	Summary
Backfill matching and validation Library/Homebrew/attestation.rb, Library/Homebrew/test/attestation_spec.rb	The attestation check excludes BACKFILL_REPO from the :all bottle formula-name/version matching rule. Tests verify acceptance of a matching URL-prefixed subject and rejection when the URL, digest, or prefix does not match.

Merge Risk: Minimal · up to ee46e

Backfilled :all bottles now require the expected URL-prefixed subject. No actionable merge-blocking issue was identified; the tests use mocked attestation responses.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the main change: verifying subjects for backfilled :all bottles.
Description check		The description explains the matching issue, the code change, regression tests, validation results, and scope. It is directly related to the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Warning

Some tools did not complete. Review the errors below.

ast-grep (0.51.1)

ast-grep could not parse rule config: /ast-grep-rules/ast-grep-essentials/rules/javascript/security/no-children-prop.yml

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f07057d1-a403-4ef0-a56a-62402125161e

Commits

Reviewing files that changed from the base of the PR and between f6051a7 and ee46e78.

Files selected for processing: 2

• Library/Homebrew/attestation.rb
• Library/Homebrew/test/attestation_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[MikeMcQuaid]

Thanks!