homebrew role fails on fresh converge: Homebrew 6.x mandatory tap-trust blocks forgejo taps #325

New issue

Open

opened 2026-06-14 17:05:45 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-14 17:05:45 +00:00

Owner

Summary

On a fresh host converge, the homebrew role fails at "Ensure Homebrew formulae are present" because Homebrew 6.x now enforces mandatory tap trust. The three forgejo taps ship untrusted, so brew refuses their formulae and aborts the whole batch install.

Observed on

Host: kai-tower-3026-wsl (WSL2, fresh bootstrap), Homebrew 6.0.1.
First full sync.py apply died at the homebrew role. Error excerpt:

Warning: The following taps are not trusted:
  coilyco-bridge/coily
  coilyco-flight-deck/otel-a2a-relay-cli
  coilyco-flight-deck/ward
Homebrew is currently ignoring formulae ... because tap trust is required.
...
Error: Failure while executing; `... build.rb .../Formula/coily.rb` exited with 1.

Only 6 formulae landed in the Cellar. The from-source coily build also failed while the tap was untrusted.

Root cause

Homebrew 6.x requires brew trust <tap> for third-party taps before it will run their formula code. The role adds the taps but never trusts them.

Fix (manual workaround that unblocked the converge)

brew trust coilyco-bridge/coily coilyco-flight-deck/otel-a2a-relay-cli coilyco-flight-deck/ward

After trusting, brew install coilyco-bridge/coily/coily builds from source in ~7s and the full converge completes (ok=147, only the unrelated gh-auth sync-repo-registry collector fails).

Proposed role change

In the homebrew role, after "Ensure Homebrew taps are present" and before installing formulae, run brew trust for each fleet-owned tap (the forgejo coilyco-* taps). Setting HOMEBREW_NO_REQUIRE_TAP_TRUST=1 is the documented escape hatch but Homebrew flags it as not recommended and slated for removal, so per-tap brew trust is the durable path.

This will bite every future fresh-host bootstrap until fixed.

## Summary On a fresh host converge, the `homebrew` role fails at "Ensure Homebrew formulae are present" because Homebrew 6.x now enforces mandatory **tap trust**. The three forgejo taps ship untrusted, so brew refuses their formulae and aborts the whole batch install. ## Observed on - Host: `kai-tower-3026-wsl` (WSL2, fresh bootstrap), Homebrew 6.0.1. - First full `sync.py apply` died at the homebrew role. Error excerpt: ``` Warning: The following taps are not trusted: coilyco-bridge/coily coilyco-flight-deck/otel-a2a-relay-cli coilyco-flight-deck/ward Homebrew is currently ignoring formulae ... because tap trust is required. ... Error: Failure while executing; `... build.rb .../Formula/coily.rb` exited with 1. ``` Only 6 formulae landed in the Cellar. The from-source `coily` build also failed while the tap was untrusted. ## Root cause Homebrew 6.x requires `brew trust <tap>` for third-party taps before it will run their formula code. The role adds the taps but never trusts them. ## Fix (manual workaround that unblocked the converge) ``` brew trust coilyco-bridge/coily coilyco-flight-deck/otel-a2a-relay-cli coilyco-flight-deck/ward ``` After trusting, `brew install coilyco-bridge/coily/coily` builds from source in ~7s and the full converge completes (ok=147, only the unrelated gh-auth `sync-repo-registry` collector fails). ## Proposed role change In the `homebrew` role, after "Ensure Homebrew taps are present" and before installing formulae, run `brew trust` for each fleet-owned tap (the forgejo `coilyco-*` taps). Setting `HOMEBREW_NO_REQUIRE_TAP_TRUST=1` is the documented escape hatch but Homebrew flags it as not recommended and slated for removal, so per-tap `brew trust` is the durable path. This will bite every future fresh-host bootstrap until fixed.

coilysiren added the

label

2026-06-17 07:07:07 +00:00

coilysiren added

interactive

and removed

labels

2026-06-18 06:19:03 +00:00