Merge branch 'master' into ww/attestations-for-dev

.github/workflows/autogenerated-files.yml

@@ -30,7 +30,7 @@ jobs:
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

.github/workflows/codeql-analysis.yml

@@ -19,15 +19,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@319cdb9fa619417d07cc37a964f0502bfbc5e8a9 # v3
         with:
           languages: ruby
           config: |
             paths-ignore:
               - Library/Homebrew/vendor
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@319cdb9fa619417d07cc37a964f0502bfbc5e8a9 # v3

.github/workflows/docker.yml

@@ -25,7 +25,7 @@ jobs:
         version: ["18.04", "20.04", "22.04", "24.04"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/docs.yml

@@ -30,7 +30,7 @@ jobs:
           test-bot: false
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Install vale
         run: brew install vale

.github/workflows/pkg-installer.yml

@@ -70,7 +70,7 @@ jobs:
         run: rm -f "${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}"
 
       - name: Checkout another Homebrew to brew subdirectory
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           path: brew
           fetch-depth: 0
@@ -120,7 +120,7 @@ jobs:
           fi
 
       - name: Upload installer to GitHub Actions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4
         with:
           name: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
           path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
@@ -142,7 +142,7 @@ jobs:
             name: macos-14-arm64
     steps:
       - name: Download installer from GitHub Actions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: "${{ needs.build.outputs.installer_path }}"
 
@@ -191,7 +191,7 @@ jobs:
       contents: write
     steps:
       - name: Download installer from GitHub Actions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: "${{ needs.build.outputs.installer_path }}"
 

.github/workflows/rubydoc.yml

@@ -32,7 +32,7 @@ jobs:
           test-bot: false
 
       - name: Checkout Homebrew/rubydoc.brew.sh
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           repository: Homebrew/rubydoc.brew.sh
           path: rubydoc

.github/workflows/sponsors-maintainers-man-completions.yml

@@ -45,7 +45,7 @@ jobs:
           signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

.github/workflows/stale-issues.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Mark/Close Stale Issues and Pull Requests
-        uses: actions/stale@v9
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 21
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Mark/Close Stale `bump-formula-pr` and `bump-cask-pr` Pull Requests
-        uses: actions/stale@v9
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 2

.github/workflows/tests.yml

@@ -35,7 +35,7 @@ jobs:
           test-bot: false
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -48,7 +48,7 @@ jobs:
         run: brew install shellcheck shfmt
 
       - name: Cache style cache
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ~/.cache/Homebrew/style
           key: syntax-style-cache-${{ github.sha }}
@@ -87,7 +87,7 @@ jobs:
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-tap-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -97,7 +97,7 @@ jobs:
         run: brew install-bundler-gems --groups=style
 
       - name: Cache style cache
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ~/.cache/Homebrew/style
           key: tap-syntax-style-cache-${{ github.sha }}
@@ -309,7 +309,7 @@ jobs:
           test-bot: false
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ matrix.runs-on }}-tests-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -324,7 +324,7 @@ jobs:
         run: mkdir tests
 
       - name: Cache parallel tests log
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: tests
           key: ${{ runner.os }}-${{ matrix.test-flags }}-parallel_runtime_rspec-${{ github.sha }}

.github/workflows/vendor-gems.yml

@@ -98,7 +98,7 @@ jobs:
           fi
 
       - name: Generate push token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1
         id: app-token
         if: github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch'
         with:

Library/Homebrew/cask.rb

@@ -20,5 +20,6 @@
 require "cask/pkg"
 require "cask/quarantine"
 require "cask/staged"
+require "cask/tab"
 require "cask/url"
 require "cask/utils"

Library/Homebrew/cask/cask.rb

@@ -7,6 +7,7 @@
 require "cask/config"
 require "cask/dsl"
 require "cask/metadata"
+require "cask/tab"
 require "utils/bottles"
 require "extend/api_hashable"
 
@@ -158,6 +159,17 @@ def caskfile_only?
       languages.any? || artifacts.any?(Artifact::AbstractFlightBlock)
     end
 
+    def uninstall_flight_blocks?
+      artifacts.any? do |artifact|
+        case artifact
+        when Artifact::PreflightBlock
+          artifact.directives.key?(:uninstall_preflight)
+        when Artifact::PostflightBlock
+          artifact.directives.key?(:uninstall_postflight)
+        end
+      end
+    end
+
     sig { returns(T.nilable(Time)) }
     def install_time
       # <caskroom_path>/.metadata/<version>/<timestamp>/Casks/<token>.{rb,json} -> <timestamp>
@@ -209,6 +221,10 @@ def bundle_long_version
       bundle_version&.version
     end
 
+    def tab
+      Tab.for_cask(self)
+    end
+
     def config_path
       metadata_main_container_path/"config.json"
     end
@@ -465,6 +481,27 @@ def to_hash_with_variations(hash_method: :to_h)
       hash
     end
 
+    def artifacts_list(compact: false, uninstall_only: false)
+      artifacts.filter_map do |artifact|
+        case artifact
+        when Artifact::AbstractFlightBlock
+          uninstall_flight_block = artifact.directives.key?(:uninstall_preflight) ||
+                                   artifact.directives.key?(:uninstall_postflight)
+          next if uninstall_only && !uninstall_flight_block
+
+          # Only indicate whether this block is used as we don't load it from the API
+          # We can skip this entirely once we move to internal JSON v3.
+          { artifact.summarize.to_sym => nil } unless compact
+        else
+          zap_artifact = artifact.is_a?(Artifact::Zap)
+          uninstall_artifact = artifact.respond_to?(:uninstall_phase) || artifact.respond_to?(:post_uninstall_phase)
+          next if uninstall_only && !zap_artifact && !uninstall_artifact
+
+          { artifact.class.dsl_key => artifact.to_args }
+        end
+      end
+    end
+
     private
 
     sig { returns(T.nilable(Homebrew::BundleVersion)) }
@@ -482,19 +519,6 @@ def api_to_local_hash(hash)
       hash
     end
 
-    def artifacts_list(compact: false)
-      artifacts.filter_map do |artifact|
-        case artifact
-        when Artifact::AbstractFlightBlock
-          # Only indicate whether this block is used as we don't load it from the API
-          # We can skip this entirely once we move to internal JSON v3.
-          { artifact.summarize => nil } unless compact
-        else
-          { artifact.class.dsl_key => artifact.to_args }
-        end
-      end
-    end
-
     def url_specs
       url&.specs.dup.tap do |url_specs|
         case url_specs&.dig(:user_agent)

Library/Homebrew/cask/cask_loader.rb

@@ -12,6 +12,9 @@ module Cask
   module CaskLoader
     extend Context
 
+    ALLOWED_URL_SCHEMES = %w[file].freeze
+    private_constant :ALLOWED_URL_SCHEMES
+
     module ILoader
       extend T::Helpers
       interface!
@@ -171,17 +174,25 @@ def self.try_new(ref, warn: false)
         new(uri)
       end
 
-      attr_reader :url
+      attr_reader :url, :name
 
       sig { params(url: T.any(URI::Generic, String)).void }
       def initialize(url)
         @url = URI(url)
-        super Cache.path/File.basename(T.must(@url.path))
+        @name = File.basename(T.must(@url.path))
+        super Cache.path/name
       end
 
       def load(config:)
         path.dirname.mkpath
 
+        if ALLOWED_URL_SCHEMES.exclude?(url.scheme)
+          raise UnsupportedInstallationMethod,
+                "Non-checksummed download of #{name} formula file from an arbitrary URL is unsupported! " \
+                "`brew extract` or `brew create` and `brew tap-new` to create a formula file in a tap " \
+                "on GitHub instead."
+        end
+
         begin
           ohai "Downloading #{url}"
           ::Utils::Curl.curl_download url, to: path

Library/Homebrew/cask/info.rb

@@ -12,7 +12,7 @@ def self.get_info(cask)
       output << "#{Formatter.url(cask.homepage)}\n" if cask.homepage
       deprecate_disable = DeprecateDisable.message(cask)
       output << "#{deprecate_disable.capitalize}\n" if deprecate_disable
-      output << installation_info(cask)
+      output << "#{installation_info(cask)}\n"
       repo = repo_info(cask)
       output << "#{repo}\n" if repo
       output << name_info(cask)
@@ -37,7 +37,7 @@ def self.title_info(cask)
     end
 
     def self.installation_info(cask)
-      return "Not installed\n" unless cask.installed?
+      return "Not installed" unless cask.installed?
 
       versioned_staged_path = cask.caskroom_path.join(cask.installed_version)
       path_details = if versioned_staged_path.exist?
@@ -46,7 +46,12 @@ def self.installation_info(cask)
         Formatter.error("does not exist")
       end
 
-      "Installed\n#{versioned_staged_path} (#{path_details})\n"
+      tab = Tab.for_cask(cask)
+
+      info = ["Installed"]
+      info << "#{versioned_staged_path} (#{path_details})"
+      info << "  #{tab}" if tab.tabfile&.exist?
+      info.join("\n")
     end
 
     def self.name_info(cask)