Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions .cursorrules

This file was deleted.

File renamed without changes.
File renamed without changes.
6 changes: 3 additions & 3 deletions praisonai.rb
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ class Praisonai < Formula

desc "AI tools for various AI applications"
homepage "https://github.com/MervinPraison/PraisonAI"
url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/2.1.1.tar.gz"
sha256 "1828fb9227d10f991522c3f24f061943a254b667196b40b1a3e4a54a8d30ce32" # Replace with actual SHA256 checksum
url "https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v2.2.16.tar.gz"
sha256 `curl -sL https://github.com/MervinPraison/PraisonAI/archive/refs/tags/v2.2.16.tar.gz | shasum -a 256`.split.first
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This change introduces a dynamic calculation for the SHA256 checksum using curl and shasum at the time the Homebrew formula is processed. While this might seem convenient for keeping the checksum up-to-date, it deviates from common Homebrew best practices and introduces potential issues:

  1. Security Risk: Calculating the checksum at install time means Homebrew trusts that the downloaded content from the URL hasn't been tampered with at that moment of download by the end user. Hardcoding the SHA256 ensures verification against a known, pre-vetted checksum for a specific artifact. If the source (GitHub in this case) or the download process were compromised, a dynamic checksum could inadvertently validate malicious content.
  2. Reproducibility: If the tag v2.2.16 were ever force-pushed with different content (a bad practice, but possible), the checksum generated by this command would change. This could break reproducibility for users or CI systems that rely on fetching a specific, immutable artifact version. A hardcoded checksum pins the formula to one exact version of the tarball.
  3. Homebrew Best Practice: Homebrew core formulae, and it's generally recommended for taps as well, use hardcoded SHA256 checksums. This is to guarantee the integrity and immutability of the downloaded artifact, providing a stronger security posture.

Could you elaborate on the reasoning for this dynamic approach? Would it be possible to revert to a hardcoded SHA256 checksum? This can be obtained by downloading the v2.2.16.tar.gz artifact and running shasum -a 256 PraisonAI-v2.2.16.tar.gz (or similar filename) locally, then placing the output in the formula.

    sha256 "YOUR_PRECALCULATED_SHA256_FOR_V2.2.16_HERE" # Please calculate and insert the correct SHA256 sum for v2.2.16.tar.gz

license "MIT"

depends_on "python@3.9"
depends_on "python@3.11"

def install
virtualenv_install_with_resources
Expand Down
Loading