ci: fix L4 vm-e2e under Homebrew tap-trust + stale OMZ hash#130
Merged
Conversation
Recent Homebrew refuses to load formulae/casks from untrusted third-party
taps ('Refusing to load formula ... from untrusted tap'). This broke the
L4 suite two ways on the macos-14 runner:
- TestVM_Interactive_InstallScript: 'brew install openboot' from the
openbootdotdev/tap tap is refused.
- The runner ships aws/tap, azure/bicep and hashicorp/tap pre-tapped and
untrusted, so brew operations the suite drives emit trust errors.
Trust all pre-existing taps in the workflow and trust openbootdotdev/tap
in the install helper. Also log the install output in
TestVM_Edge_ShellActuallyWorks on failure — it previously discarded the
dev-binary output, making its fast exit impossible to diagnose.
…e hash InstallOhMyZsh fetched the installer from the ohmyzsh master branch but verified it against a hash pinned on 2026-04-19. Upstream rewrote tools/install.sh on 2026-06-15, so every 'openboot install --shell install' now aborts with 'hash mismatch: download may be compromised' — a real user-facing break, not just a test failure. Pin the URL to commit 96ea17080a7addd1cd8b6253422776bc237fc6b1 and refresh the hash to that commit's script (verified independently: 4534045f...77bb). Pinning URL + hash to the same immutable commit keeps them consistent so a future upstream edit can't silently break the installer again.
The OMZ pin comment added 6 lines, shifting the pre-existing exec.Command in InstallOhMyZsh from line 178 to 184. Same call, no new violation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Gets the L4 vm-e2e suite (
vm-e2e-spike.yml) green again and fixes a real user-facing break it surfaced:openboot install --shell installaborting on a stale Oh-My-Zsh hash.Why?
L4 had two unrelated failures, neither caused by recent feature work (#129):
Homebrew tap-trust enforcement. Recent Homebrew refuses to load formulae/casks from untrusted third-party taps. This broke
TestVM_Interactive_InstallScript(installs fromopenbootdotdev/tap) and the macos-14 runner shipsaws/tap,azure/bicep,hashicorp/tappre-tapped and untrusted. Fixed by trusting pre-existing taps in the workflow andopenbootdotdev/tapin the install helper. (CI/test-only.)Stale pinned Oh-My-Zsh installer hash.
InstallOhMyZshfetched the installer from the ohmyzshmasterbranch but verified it against a hash pinned 2026-04-19. Upstream rewrotetools/install.shon 2026-06-15, so everyopenboot install --shell installnow aborts with "hash mismatch: download may be compromised". Fixed by pinning the URL to an immutable commit (96ea1708) and refreshing the hash — pinning URL+hash to the same commit stops a future upstream edit from silently breaking the installer again. (Real production fix.)The edge test also now logs the dev-binary output on failure (it previously discarded it, making the fast exit impossible to diagnose).
Testing
go vet ./...passesEdge_ShellActuallyWorks,FullSetupConfiguresEverything)4534045f…77bb)Cross-repo checklist
openboot.dev? — No.Notes for reviewer
.github/workflows/vm-e2e-spike.ymlbut only adds a setup step to a non-required workflow — no branch-protection / required-check changes, so no GitHub UI action needed.ci:(tap-trust, test-only) andfix:(OMZ pin, production).master→commit pin is a behaviour change: users now get the installer from a fixed verified commit rather than latest master. This is intentional — it makes the supply-chain hash check coherent.