Support Homebrew install #279
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| # This file is auto-generated by scripts/update-homebrew-formula.sh on each | ||
| # release. Do not edit this file directly — edit the template in the | ||
| # clickhousectl repo (homebrew/clickhousectl.rb.tmpl) and re-run the script. | ||
|
|
||
| class Clickhousectl < Formula | ||
| desc "CLI for ClickHouse: local and cloud" | ||
| homepage "https://github.com/ClickHouse/clickhousectl" | ||
| version "{{VERSION}}" | ||
| license "Apache-2.0" | ||
|
|
||
| # Prebuilt binaries are served from builds.clickhouse.com. The SHA256 is | ||
| # computed from the identical GitHub release assets (same bytes) by | ||
| # scripts/update-homebrew-formula.sh at release time. | ||
| livecheck do | ||
| url :stable | ||
| strategy :github_latest | ||
| end | ||
|
|
||
| on_macos do | ||
| on_intel do | ||
| url "https://builds.clickhouse.com/clickhousectl/clickhousectl-x86_64-apple-darwin-v{{VERSION}}.tar.gz" | ||
| sha256 "{{SHA256_X86_64_APPLE_DARWIN}}" | ||
| end | ||
| on_arm do | ||
| url "https://builds.clickhouse.com/clickhousectl/clickhousectl-aarch64-apple-darwin-v{{VERSION}}.tar.gz" | ||
| sha256 "{{SHA256_AARCH64_APPLE_DARWIN}}" | ||
| end | ||
| end | ||
|
|
||
| on_linux do | ||
| on_intel do | ||
| url "https://builds.clickhouse.com/clickhousectl/clickhousectl-x86_64-unknown-linux-musl-v{{VERSION}}.tar.gz" | ||
| sha256 "{{SHA256_X86_64_LINUX_MUSL}}" | ||
| end | ||
| on_arm do | ||
| url "https://builds.clickhouse.com/clickhousectl/clickhousectl-aarch64-unknown-linux-musl-v{{VERSION}}.tar.gz" | ||
| sha256 "{{SHA256_AARCH64_LINUX_MUSL}}" | ||
| end | ||
| end | ||
|
|
||
| def install | ||
| # The archive contains a single directory: clickhousectl-{target}-v{version}/clickhousectl | ||
| bin.install "clickhousectl" | ||
| # Match install.sh: create a chctl symlink for convenience. | ||
| bin.install_symlink "clickhousectl" => "chctl" | ||
| end | ||
|
|
||
| test do | ||
| assert_match(/^clickhousectl #{Regexp.escape(version.to_s)}$/, shell_output("#{bin}/clickhousectl --version")) | ||
| end | ||
| end |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| #!/usr/bin/env bash | ||
| # | ||
| # update-homebrew-formula.sh — render the Homebrew formula template with the | ||
| # version and SHA256 hashes for a given release, then commit it to the | ||
| # ClickHouse/homebrew-tap repo. | ||
| # | ||
| # Usage: | ||
| # ./scripts/update-homebrew-formula.sh <version> | ||
| # | ||
| # <version> Release version WITHOUT leading "v" (e.g. 0.3.1). | ||
| # | ||
| # Environment: | ||
| # HOMEBREW_TAP_DEPLOY_KEY Private SSH key registered as a deploy key with | ||
| # write access on ClickHouse/homebrew-tap (required). | ||
| # GITHUB_REPOSITORY Set by GitHub Actions (e.g. ClickHouse/clickhousectl). | ||
| # | ||
| # The script: | ||
| # 1. Downloads the 4 prebuilt archives from the GitHub release (immediately | ||
| # available, no mirror propagation delay) and computes SHA256 for each. | ||
| # 2. Renders homebrew/clickhousectl.rb.tmpl with the version + hashes. | ||
| # 3. Clones ClickHouse/homebrew-tap, replaces Formula/clickhousectl.rb, | ||
| # commits and pushes. | ||
| # | ||
| # The formula's download URLs point at builds.clickhouse.com (same bytes) so | ||
| # installs use the same distribution path as install.sh, cargo binstall, npm, | ||
| # and pip. | ||
| set -euo pipefail | ||
|
|
||
| VERSION="${1:?usage: $0 <version> (without leading v)}" | ||
| TAG="v${VERSION}" | ||
| TAP_REPO="ClickHouse/homebrew-tap" | ||
| TEMPLATE="homebrew/clickhousectl.rb.tmpl" | ||
|
|
||
| if [ -z "${HOMEBREW_TAP_DEPLOY_KEY:-}" ]; then | ||
| echo "error: HOMEBREW_TAP_DEPLOY_KEY is not set" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # ── 1. Download archives and compute SHA256 ──────────────────────────────── | ||
| # GitHub release assets are named clickhousectl-{target}-v{version}.tar.gz. | ||
| # The bytes are identical to builds.clickhouse.com, so we compute hashes from | ||
| # GitHub (available immediately after the release job) and use builds URLs in | ||
| # the formula for the canonical distribution path. | ||
| GH_BASE="https://github.com/ClickHouse/clickhousectl/releases/download/${TAG}" | ||
|
|
||
| declare -A TARGETS=( | ||
| [X86_64_LINUX_MUSL]="x86_64-unknown-linux-musl" | ||
| [AARCH64_LINUX_MUSL]="aarch64-unknown-linux-musl" | ||
| [X86_64_APPLE_DARWIN]="x86_64-apple-darwin" | ||
| [AARCH64_APPLE_DARWIN]="aarch64-apple-darwin" | ||
| ) | ||
|
|
||
| declare -A HASHES | ||
|
|
||
| TMPDIR="$(mktemp -d)" | ||
| trap 'rm -rf "$TMPDIR"' EXIT | ||
|
|
||
| for key in "${!TARGETS[@]}"; do | ||
| target="${TARGETS[$key]}" | ||
| asset="clickhousectl-${target}-${TAG}.tar.gz" | ||
| url="${GH_BASE}/${asset}" | ||
| echo "Downloading ${asset}..." | ||
| curl -fsSL "$url" -o "${TMPDIR}/${asset}" | ||
| hash="$(shasum -a 256 "${TMPDIR}/${asset}" | awk '{print $1}')" | ||
| HASHES[$key]="$hash" | ||
| echo " sha256: ${hash}" | ||
| done | ||
|
|
||
| # ── 1b. Verify builds.clickhouse.com URLs are reachable ──────────────────── | ||
| # The formula serves from builds.clickhouse.com, which is populated async | ||
| # from the GitHub release. Fail fast if the mirror isn't ready yet so the | ||
| # tap isn't published with 404 URLs — re-run this job after the async push | ||
| # completes. | ||
| BUILDS_BASE="https://builds.clickhouse.com/clickhousectl" | ||
| for key in "${!TARGETS[@]}"; do | ||
| target="${TARGETS[$key]}" | ||
| asset="clickhousectl-${target}-${TAG}.tar.gz" | ||
| builds_url="${BUILDS_BASE}/${asset}" | ||
| echo "Verifying ${builds_url}..." | ||
| if ! curl -fsSI "$builds_url" -o /dev/null; then | ||
| echo "error: ${builds_url} is not reachable." >&2 | ||
| echo " builds.clickhouse.com may not have propagated this release yet." >&2 | ||
| echo " Trigger the async push and re-run this job." >&2 | ||
| exit 1 | ||
| fi | ||
| echo " OK" | ||
| done | ||
|
There was a problem hiding this comment. Mirror SHA256 never verifiedMedium Severity The update script records SHA256 from GitHub release downloads but only sends HTTP HEAD to Additional Locations (1)  Reviewed by Cursor Bugbot for commit 9e8d2d6. Configure here. |
||
|
|
||
| # ── 2. Render the template ───────────────────────────────────────────────── | ||
| if [ ! -f "$TEMPLATE" ]; then | ||
| echo "error: template not found: ${TEMPLATE}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| RENDERED="${TMPDIR}/clickhousectl.rb" | ||
| sed \ | ||
| -e "s|{{VERSION}}|${VERSION}|g" \ | ||
| -e "s|{{SHA256_X86_64_LINUX_MUSL}}|${HASHES[X86_64_LINUX_MUSL]}|g" \ | ||
| -e "s|{{SHA256_AARCH64_LINUX_MUSL}}|${HASHES[AARCH64_LINUX_MUSL]}|g" \ | ||
| -e "s|{{SHA256_X86_64_APPLE_DARWIN}}|${HASHES[X86_64_APPLE_DARWIN]}|g" \ | ||
| -e "s|{{SHA256_AARCH64_APPLE_DARWIN}}|${HASHES[AARCH64_APPLE_DARWIN]}|g" \ | ||
| "$TEMPLATE" > "$RENDERED" | ||
|
|
||
| echo "Rendered formula:" | ||
| head -5 "$RENDERED" | ||
|
|
||
| # ── 3. Clone the tap, update, commit, push ───────────────────────────────── | ||
| # Use a deploy key (SSH) for authentication — scoped to the tap repo only, | ||
| # not tied to any individual's GitHub account. | ||
| TAP_DIR="${TMPDIR}/homebrew-tap" | ||
| SSH_KEY="${TMPDIR}/deploy_key" | ||
| printf '%s\n' "$HOMEBREW_TAP_DEPLOY_KEY" > "$SSH_KEY" | ||
| chmod 600 "$SSH_KEY" | ||
|
|
||
| # Pin GitHub's published ed25519 SSH key so a MITM attacker can't substitute | ||
| # their own host key during the deploy-key session. See: | ||
| # https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints | ||
| echo "github.com ssh-ed25519 AAAAC3NzC1lZDI1NTE5AAAAIOMqqnkVzq0S2G4Ue0hKQipxwlPGB0XzYxgO0GR6djQx" > "${TMPDIR}/known_hosts" | ||
|
|
||
| GIT_SSH_COMMAND="ssh -i ${SSH_KEY} -o UserKnownHostsFile=${TMPDIR}/known_hosts -o IdentitiesOnly=yes" \ | ||
| git clone "git@github.com:${TAP_REPO}.git" "$TAP_DIR" | ||
| mkdir -p "${TAP_DIR}/Formula" | ||
| cp "$RENDERED" "${TAP_DIR}/Formula/clickhousectl.rb" | ||
|
|
||
| git -C "$TAP_DIR" add Formula/clickhousectl.rb | ||
| # Allow a no-op commit when the formula is already up to date (e.g. a | ||
| # re-run of the release job after the first push succeeded). | ||
| if ! git -C "$TAP_DIR" diff --cached --quiet; then | ||
| git -C "$TAP_DIR" -c user.name="github-actions[bot]" \ | ||
| -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \ | ||
| commit -m "clickhousectl ${VERSION}" | ||
| else | ||
| echo "Formula unchanged; nothing to commit." | ||
| fi | ||
|
|
||
| GIT_SSH_COMMAND="ssh -i ${SSH_KEY} -o UserKnownHostsFile=${TMPDIR}/known_hosts -o IdentitiesOnly=yes" \ | ||
| git -C "$TAP_DIR" push origin HEAD | ||
| echo "Pushed clickhousectl ${VERSION} to ${TAP_REPO}" | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Homebrew ignores Cargo tag alignment
Medium Severity
The new
publish-homebrewjob sets the formulaversionfrom the git tag and runsbrew test-style checks against the binary, but release archives still come from the existingbuildjob, which never realignscrates/clickhousectl/Cargo.tomlto the tag. Thebuild-wheelsjob already documents and fixes that mismatch for PyPI; Homebrew can publish a tap version that does not match--versionfrom the shipped binary when the tag was pushed without a Cargo bump.Additional Locations (2)
homebrew/clickhousectl.rb.tmpl#L7-L9homebrew/clickhousectl.rb.tmpl#L47-L49Reviewed by Cursor Bugbot for commit 84d0f9f. Configure here.