Homebrew tap r-lib/rig is not trusted on macOS

[gvelasq]

Hello,

I began receiving this error recently when upgrading casks on Homebrew:

Warning: The following taps are not trusted:
  r-lib/rig

Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required.
Trust specific formulae, casks or commands with:
  brew trust --formula <user>/<tap>/<formula>
  brew trust --cask <user>/<tap>/<cask>
  brew trust --command <user>/<tap>/<command>

Trying to specifically query the Homebrew cask for rig is also disallowed:

% brew info --cask rig
Error: Refusing to load cask r-lib/rig/rig from untrusted tap r-lib/rig.
Run `brew trust --cask r-lib/rig/rig` or `brew trust r-lib/rig` to trust it.

[gaborcsardi]

This is a homebrew security feature. There is nothing we can do about this, short of moving the rig cask into the official homebrew/cask. Run

brew trust r-lib/rig

after the first

brew tap r-lib/rig

(I don't really understand why one would do brew tap for an untrusted cask, but I am probably missing something.)

[jabenninghoff]

Why not move the rig cask into homebrew/cask?

[gaborcsardi]

Why not move the rig cask into homebrew/cask?

rig is already in homebrew proper, without the menu bar app, so you can already do brew add rig.

Adding the menu bar app would probably cause confusion, as it comes with its own embedded rig.

I tried adding the menu bar app to rig in homebrew, but homebrew maintainers didn't want it.

So I am afraid we'll just add brew trust r-lib/rig to the installation instructions.

[jabenninghoff]

FYI, shortly after I posted my comment here, I submitted a new cask to Homebrew that was accepted yesterday, so rig exists in Homebrew both as a formula (command line only) and cask (GUI, macOS only).

You can install the formula with brew install r-rig and the cask with brew install r-rig-app. This adheres to the Homebrew naming convention - there was an older formula called 'rig', the existing command line version of r-lib/rig was named 'r-rig', the name for a GUI version of a tool adds the '-app' suffix.

[gaborcsardi]

Thanks! So the r-rig-app cask only contains the menu bar app, but not the CLI?

Is it possible to require the same version of r-rig in r-rig-app? Otherwise there is a risk that they won't work well together.

[jabenninghoff]

@gaborcsardi the cask downloads and installs the appropriate package for the system's architecture, so there's no issue there.

[jabenninghoff]

https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/r/r-rig-app.rb

[gaborcsardi]

What I mean is that with r-rig-app 0.9.0 you'll want r-rig 0.9.0 because it does not work well with r-rig 0.8.0. In general you need the same version for both.

[jabenninghoff]

Normally, you'd install either r-rig OR r-rig app. The r-rig formula installs just the command line tool, the r-rig-app cask installs either rig-0.8.0-macOS-arm64.pkg or rig-0.8.0-macOS-x86_64.pkg, just as https://github.com/r-lib/homebrew-rig/blob/main/Casks/rig.rb does (the new cask is functionally equivalent).

[gvelasq]

If I understand correctly, r-rig installs the CLI and r-rig-app installs both the CLI and the macOS GUI.

Would it be helpful to flag the r-rig and r-rig-app formulae with a conflicts_with argument, such that users can install only one or the other?

https://docs.brew.sh/rubydoc/Formula.html#conflicts_with-class_method

[jabenninghoff]

If I understand correctly, r-rig installs the CLI and r-rig-app installs both the CLI and the macOS GUI.

Yes!

Woukd it be helpful to flag the r-rig and r-rig-app formulae with a conflicts_with argument, such that users can install only one or the other?

https://docs.brew.sh/rubydoc/Formula.html#conflicts_with-class_method

It would, if it were possible, formulas can declare conflicts with other formulas, casks can declare conflicts with other casks, but not to formulas (or vice versa).

Perhaps the rig package installer could check for an installed version of the rig command line?

[jabenninghoff]

I'd add that it's always been possible to install both the formula (r-rig) and cask (r-lib/rig/rig). With both now in Homebrew, it's less likely that someone would have both installed on different versions, given that Homebrew will automatically update both the formula and cask when a new version of rig is released on GitHub.

[gaborcsardi]

r-lib/rig/rig has both the cli and the app in one package.