From 237cd40c73055b76ccf6f1dfc56c51709566df9a Mon Sep 17 00:00:00 2001 From: Daniel Young Date: Fri, 23 Oct 2026 21:37:57 -0400 Subject: [PATCH 1/2] [tailctl] Update to 0.2.0 Security release: shields are enforced on every instance and claim, and a listen_host setting keeps the proxies off the container-reachable 127.0.0.1. Dependencies are unchanged, so only the sdist url and sha256 move. Solves: ship tailctl 0.2.0 to Homebrew users Tests: brew style, brew audit --strict; sha256 matches a local download --- Formula/tailctl.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Formula/tailctl.rb b/Formula/tailctl.rb index a2cff5d..8c5b79f 100644 --- a/Formula/tailctl.rb +++ b/Formula/tailctl.rb @@ -3,8 +3,8 @@ class Tailctl < Formula desc "Per-identity Tailscale networking for parallel sessions on a single Mac" homepage "https://github.com/DRYCodeWorks/tailctl" - url "https://files.pythonhosted.org/packages/eb/ec/44787a94cb609e6ad06ace0fe82fb5444acaa0e6c78a1100bdbd89d2adbb/tailctl-0.1.1.tar.gz" - sha256 "c4f63c97ea17a947c24f0b48232256a8b16707f962125186a234a34dc8ed20cc" + url "https://files.pythonhosted.org/packages/f0/be/bf470ff244523e00a83cad9a8b9cf1d70ba59fdb0bcb759969ec6d8efe59/tailctl-0.2.0.tar.gz" + sha256 "ba133a7d1df11b00f27647480cb60762e21f1596a6ee154055217b49c627f84f" license "MIT" # Bumps here are manual, so let `brew livecheck` spot new PyPI releases. From 1b4d114c197b8d88a10a1b36882d9e164e008350 Mon Sep 17 00:00:00 2001 From: Daniel Young Date: Fri, 23 Oct 2026 21:43:21 -0400 Subject: [PATCH 2/2] [tacet] Move the cask to Homebrew 7 syntax Homebrew 7 rejects legacy flight blocks in tap style checks and deprecates `verified:` on url, which failed every leg of the tap's CI for any change. Steps take only literal arguments, so the quarantine clear moves to preflight_steps on the staged bundle: Homebrew sets the flag on download and extraction and never re-applies it after the app artifact moves the bundle, so the installed copy arrives clean before anything can exec it. Solves: tap CI red on Homebrew 7; blocks the tailctl 0.2.0 bump Tests: brew style, readall and audit pass locally; CI's cask install and exec-hang check covers the quarantine path --- Casks/tacet.rb | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/Casks/tacet.rb b/Casks/tacet.rb index 8a91bca..815aa34 100644 --- a/Casks/tacet.rb +++ b/Casks/tacet.rb @@ -2,8 +2,7 @@ version "0.1.3" sha256 "6850c13401ee7e9666ab5abc81dc6b38a4d77b69be48a13a37344c64520e9e6b" - url "https://github.com/DRYCodeWorks/tacet/releases/download/v#{version}/Tacet.zip", - verified: "github.com/DRYCodeWorks/tacet/" + url "https://github.com/DRYCodeWorks/tacet/releases/download/v#{version}/Tacet.zip" name "Tacet" desc "Push-to-talk dictation that pastes the transcript at the cursor" homepage "https://github.com/DRYCodeWorks/tacet" @@ -34,12 +33,18 @@ # the fact does not recover it, and neither does replacing the file — only a # different path does. So this has to run before anything execs the binary. # + # Install steps take only literal arguments, so there is no way to name + # #{appdir}/Tacet.app. Instead this clears the flag on the staged bundle + # (`chdir` defaults to staged_path) before the app artifact moves it: + # Homebrew quarantines the download and propagates the flag on extraction, + # and nothing re-applies it after the move. A file without the attribute + # makes xattr exit non-zero, which the old system_command also ignored. + # # See DRYCodeWorks/tacet#25 for the isolation. CI enforces that this keeps # working: the cask job execs the installed bundle with --help and fails the # build on a hang, which is the signature of this bug coming back. - postflight do - system_command "/usr/bin/xattr", - args: ["-dr", "com.apple.quarantine", "#{appdir}/Tacet.app"] + preflight_steps do + run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "Tacet.app"], chdir: ".", must_succeed: false end # Deliberately NOT `depends_on formula: "whisper-cpp"`. One bundle plays two