Ship Homebrew bottles so installs pour instead of building (fixes juxt/allium#42)#50
Merged
Merged
Conversation
Fixes the durable side of juxt/allium#42. The formula ships no bottle, so `brew install/upgrade` runs the install from source in Homebrew's build sandbox; on macOS Tahoe that sandbox's deny_read_home realpaths a TCC-protected ~/Documents and aborts when the terminal lacks access. Pouring a bottle never enters that path. - scripts/build-bottle.sh builds a bottle from a prebuilt release binary via `brew bottle`, reading the tag/sha back from the JSON manifest and emitting the pourable single-dash bottle file. Validated locally against the real v3.4.0 arm64 binary: the produced bottle pours on macOS 26.5 (Tahoe). - release workflow: a `bottles` matrix job (arm64 on macos-14, x86_64 on macos-13 — the oldest runners, so `:any_skip_relocation` + Homebrew OS fallback covers all newer macOS of that arch from one bottle); publish-release attaches the bottles; update-homebrew assembles and injects a `bottle do` block (root_url = release download URL) into the formula. Linux has no TCC sandbox crash, so it ships no bottle. The formula-edit (version, source sha, bottle-block inject) was validated locally for valid Ruby and idempotency. Refs juxt/allium#42 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merged
yavorpanayotov
added a commit
that referenced
this pull request
Jun 17, 2026
Patch release to ship the Homebrew bottles added in #50, fixing the macOS Tahoe build-sandbox install failure (juxt/allium#42). No code changes beyond the version bump; the release workflow's new bottles job runs on this tag. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The durable fix for juxt/allium#42. The tap formula ships no bottle, so
brew install/upgrade alliumruns the install from source in Homebrew's build sandbox; on macOS Tahoe that sandbox'sdeny_read_homerealpaths a TCC-protected~/Documentsand aborts (rb_check_realpath_internal … EPERM) when the terminal lacks access. Pouring a bottle goes through#pour_bottle, never#build, so the realpath is never reached.Change
scripts/build-bottle.sh— builds a bottle from a prebuilt release binary viabrew bottle, reads tag/sha back from the JSON manifest, emits the pourable (single-dash) bottle file. Validated locally against the real v3.4.0 arm64 binary: the produced bottle pours on macOS 26.5 (Tahoe).bottlesjob (matrix): arm64 onmacos-14, x86_64 onmacos-13. Built on the oldest runners because the binary is:any_skip_relocationand Homebrew's OS-version fallback then pours one per-arch bottle on all newer macOS — verified empirically (anarm64_sonomabottle pours on Tahoe), so no per-OS matrix is needed.publish-releaseattaches the bottles (bottle doroot_urlpoints at the release download URL).update-homebrewassembles + injects thebottle doblock into the formula (Ruby edit validated locally for valid syntax + idempotency).Validation status — please note
brew bottlerecipe (real v3.4.0 binary → pours on Tahoe) and the formula edit.v*tag. Recommend validating on the next release (or a throwaway pre-release tag) before relying on it. PR CI here runs the normalcargo test/lint suite, which is unaffected.To fix the already-released v3.4.0 (which has no bottle), cut a
3.4.1with this merged — that release will ship bottles. A companion repro harness is in juxt/homebrew-allium#4.🤖 Generated with Claude Code