From b655ea801b4eebd902eddf305a3864400936b324 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Date: Wed, 26 Aug 2026 21:17:09 -0400 Subject: [PATCH] Trust the d3mlabs tap in the docker build-deps installer Current Homebrew refuses to load formulae from untrusted third-party taps in non-interactive runs, so every image rebuild died installing dev from the tap ("Refusing to load formula d3mlabs/d3mlabs/dev-core from untrusted tap"), and :build deps from the same tap (wwise-cli) would hit it next. Tap and trust d3mlabs/d3mlabs up front; || true keeps older brews (no trust subcommand, no policy) working, and the installs below still fail loudly if trust did not take. First seen: the snappy CI runner's base-image rebuild after its lockfiles changed. Co-authored-by: Cursor --- bin/docker-install-build-deps.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/bin/docker-install-build-deps.sh b/bin/docker-install-build-deps.sh index 42a26a9..011ddba 100755 --- a/bin/docker-install-build-deps.sh +++ b/bin/docker-install-build-deps.sh @@ -40,6 +40,17 @@ echo ">>> Installing Ruby" brew install --quiet ruby export PATH="$(brew --prefix ruby)/bin:$PATH" +# Current Homebrew refuses to load formulae from untrusted third-party taps +# ("Refusing to load formula ... from untrusted tap"). Everything below +# installs from the d3mlabs tap — dev itself on the release channel, and +# :build deps like wwise-cli — so tap and trust it up front. The || true +# keeps older brews working: they have no trust subcommand and no policy to +# satisfy, and if a trust-enforcing brew somehow skips it, the install below +# still fails loudly. +echo ">>> Trusting the d3mlabs tap" +brew tap d3mlabs/d3mlabs +brew trust d3mlabs/d3mlabs || true + if [ -n "$DEV_REF" ]; then echo ">>> Cloning d3mlabs/dev (${DEV_REF}) — source override" git clone --depth 1 --branch "$DEV_REF" https://github.com/d3mlabs/dev.git /tmp/dev