dwarfs 0.10.1 (new formula)

[mhx]

• Have you followed the guidelines for contributing?
• Have you ensured that your commits follow the commit style guide?
• Have you checked that there aren't other open pull requests for the same formula update/change?
• Have you built your formula locally with HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>, where <formula> is the name of the formula you're submitting?
• Is your test running fine brew test <formula>, where <formula> is the name of the formula you're submitting?
• Does your build pass brew audit --strict <formula> (after doing HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>)? If this is a new formula, does it pass brew audit --new <formula>?

---

[mhx]

Hi @chenrui333, quick question: I'm seeing

* Dependency 'libarchive' is provided by macOS; please replace 'depends_on' with 'uses_from_macos'.

I didn't see that when running brew audit --new --strict dwarfs locally. Also, I see plenty of formulae that depends_on "libarchive".

The two formulae I've seen that actually uses_from_macos "libarchive" have to jump through a lot of hoops to make it work and even then just get two plain header files. [1] Given that Apple don't consider libarchive public API on macOS, why would Homebrew impose this restriction?

Besides all that, the latest libarchive in Sonoma is v3.5.3 (and older releases will likely be much older than that) and I need a dependency on at least v3.6.0.

Any suggestions?

Thanks! :)

[1] And the way it's done in these formulae is probably not even fully correct; in principle, rather than fetching the sources for a random version of Apple's libarchive, you'd probably have to determine which binary version is installed and then fetch the matching sources tag. I don't think this is a viable solution.

[chenrui333]

* Dependency 'libarchive' is provided by macOS; please replace 'depends_on' with 'uses_from_macos'.

you can treat that as warming rather than a hard failure.

[mhx]

* Dependency 'libarchive' is provided by macOS; please replace 'depends_on' with 'uses_from_macos'.

you can treat that as warming rather than a hard failure.

It looks very much like a failure :)

I'll give it another try with the libarchive removed from the allowlist.

[mhx]

It's actually a hard failure if I remove my change in provided_by_macos_depends_on_allowlist.json: https://github.com/Homebrew/homebrew-core/actions/runs/10440916659/job/28911449754

[mhx]

The previous CI run that included the allowlist change was successful: https://github.com/Homebrew/homebrew-core/actions/runs/10440641636

[chenrui333]

that is audit failure, not hard failure.

[mhx]

I'm confused. Why does it fail the CI workflow then? Anything I need to do or is this PR good for review?

[chenrui333]

I'm confused. Why does it fail the CI workflow then? Anything I need to do or is this PR good for review?

if you search provided by macOS; please replace 'depends_on' with 'uses_from_macos'. you will see this discussions has popped up in the repo many times.

I think the PR is good for review.

[mhx]

I'm confused. Why does it fail the CI workflow then? Anything I need to do or is this PR good for review?

if you search provided by macOS; please replace 'depends_on' with 'uses_from_macos'. you will see this discussions has popped up in the repo many times.

I actually did and the first and second hit both suggest adding the package to the allowlist, hence my previous attempt to do just that. :)

[mhx]

You obviously have vastly more experience with Homebrew than I do, so this is just my gut feeling and not meant to criticize:

• It feels wrong to me that libarchive in not in provided_by_macos_depends_on_allowlist.json, given that 37 formulae use the Homebrew version anyway and the two formulae that use the macOS-provided version are significantly more complex because of doing so, and are probably not even fully correct.
• If also feels wrong to me that it's preferable to have a broken CI workflow rather than adding a package to the allowlist, for lack of alternative options.

If you have any pointers to the rationale behind this it would be highly appreciated. I've done a fair bit of searching, but I'm coming to different conclusions based on what I've found.

[chenrui333]

• It feels wrong to me that libarchive in not in provided_by_macos_depends_on_allowlist.json, given that 37 formulae use the Homebrew version anyway and the two formulae that use the macOS-provided version are significantly more complex because of doing so, and are probably not even fully correct.

I dont think it is wrong, we did catch some before

• If also feels wrong to me that it's preferable to have a broken CI workflow rather than adding a package to the allowlist, for lack of alternative options.

Ideally, we all like green builds, but it is not always the case

[chenrui333]

I actually did and the first and second hit both suggest adding the package to the allowlist, hence my previous attempt to do just that. :)

I would suggest you take a look at the PRs in this repo, https://github.com/Homebrew/homebrew-core/pull/135198 this ended up not adding the audit_exceptions/provided_by_macos_depends_on_allowlist.json change.

[mhx]

So how will this PR make progress now? Is there anything needed from my side?

[mhx]

Not gonna complain, but why did the build suddenly turn green despite the formula still depending on libarchive on macOS?

[carlocab]

Thanks, just one last suggestion.

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.