feat(macOS): add support for trust/untrust homebrew commands

Author: cdalvaro

salt/modules/mac_brew_pkg.py

@@ -33,6 +33,8 @@
 # Define the module's virtual name
 __virtualname__ = "pkg"
 
+_TRUST_TYPES = ("tap", "formula", "cask", "command")
+
 
 def __virtual__():
     """
@@ -895,3 +897,156 @@ def unhold(name=None, pkgs=None, sources=None, **kwargs):  # pylint: disable=W06
 
 
 unpin = unhold
+
+
+def list_trusted(type=None):
+    """
+    List trusted taps, formulae, casks and commands.
+
+    .. versionadded:: 3008.2
+
+    type
+        Filter by type. Valid values: ``tap``, ``formula``, ``cask``, ``command``.
+        When ``None`` (default), returns a dict with all trusted items grouped by
+        type (keys: ``taps``, ``formulae``, ``casks``, ``commands``). When a type
+        is specified, returns a list of trusted items of that type.
+
+    CLI Example:
+
+    .. code-block:: bash
+
+        salt '*' pkg.list_trusted
+        salt '*' pkg.list_trusted type=tap
+    """
+    if type is not None and type not in _TRUST_TYPES:
+        raise SaltInvocationError(
+            f"Invalid type '{type}'. Valid values: {', '.join(_TRUST_TYPES)}"
+        )
+
+    cmd = ["trust", "--json=v1"]
+    if type is not None:
+        cmd.append(f"--{type}")
+
+    result = _call_brew(*cmd)
+    try:
+        return salt.utils.json.loads(result["stdout"])
+    except ValueError as err:
+        msg = f'Unable to interpret output from "brew trust": {err}'
+        log.error(msg)
+        raise CommandExecutionError(msg)
+
+
+def trust(name, type=None):
+    """
+    Trust a tap, formula, cask or command so Homebrew may load it when
+    ``$HOMEBREW_REQUIRE_TAP_TRUST`` is set.
+
+    .. versionadded:: 3008.2
+
+    name
+        The name of the tap, formula, cask or command to trust. Can also be a
+        remote URL for taps.
+
+    type
+        The type of the item. Valid values: ``tap``, ``formula``, ``cask``,
+        ``command``. If not specified, Homebrew will auto-detect the type.
+
+    Returns ``True`` on success (including when the item was already trusted),
+    ``False`` on failure.
+
+    CLI Example:
+
+    .. code-block:: bash
+
+        salt '*' pkg.trust cdalvaro/tap
+        salt '*' pkg.trust cdalvaro/tap type=tap
+        salt '*' pkg.trust cdalvaro/tap/salt type=formula
+    """
+    if type is not None and type not in _TRUST_TYPES:
+        raise SaltInvocationError(
+            f"Invalid type '{type}'. Valid values: {', '.join(_TRUST_TYPES)}"
+        )
+
+    cmd = ["trust"]
+    if type is not None:
+        cmd.append(f"--{type}")
+    cmd.append(name)
+
+    try:
+        _call_brew(*cmd)
+    except CommandExecutionError:
+        log.error('Failed to trust "%s"', name)
+        return False
+
+    return True
+
+
+def untrust(name, type=None):
+    """
+    Stop trusting a tap, formula, cask or command.
+
+    .. versionadded:: 3008.2
+
+    name
+        The name of the tap, formula, cask or command to untrust.
+
+    type
+        The type of the item. Valid values: ``tap``, ``formula``, ``cask``,
+        ``command``. If not specified, Homebrew will auto-detect the type.
+
+    Returns ``True`` on success (including when the item was not trusted),
+    ``False`` on failure.
+
+    CLI Example:
+
+    .. code-block:: bash
+
+        salt '*' pkg.untrust cdalvaro/tap
+        salt '*' pkg.untrust cdalvaro/tap type=tap
+        salt '*' pkg.untrust cdalvaro/tap/salt type=formula
+    """
+    if type is not None and type not in _TRUST_TYPES:
+        raise SaltInvocationError(
+            f"Invalid type '{type}'. Valid values: {', '.join(_TRUST_TYPES)}"
+        )
+
+    cmd = ["untrust"]
+    if type is not None:
+        cmd.append(f"--{type}")
+    cmd.append(name)
+
+    try:
+        _call_brew(*cmd)
+    except CommandExecutionError:
+        log.error('Failed to untrust "%s"', name)
+        return False
+
+    return True
+
+
+def is_trusted(name, type=None):
+    """
+    Check whether a tap, formula, cask or command is trusted.
+
+    .. versionadded:: 3008.2
+
+    name
+        The name of the tap, formula, cask or command to check.
+
+    type
+        The type of the item. Valid values: ``tap``, ``formula``, ``cask``,
+        ``command``. If not specified, checks across all types.
+
+    Returns ``True`` if the item is trusted, ``False`` otherwise.
+
+    CLI Example:
+
+    .. code-block:: bash
+
+        salt '*' pkg.is_trusted cdalvaro/tap
+        salt '*' pkg.is_trusted cdalvaro/tap type=tap
+    """
+    trusted = list_trusted(type=type)
+    if isinstance(trusted, list):
+        return name in trusted
+    return any(name in items for items in trusted.values())

tests/pytests/unit/modules/test_mac_brew_pkg.py

@@ -1608,3 +1608,192 @@ def test_list_upgrades_with_options():
         mock_call_brew.assert_called_once_with(
             "outdated", "--json=v2", "--greedy", "--fetch-HEAD"
         )
+
+
+# 'list_trusted' function tests
+
+
+def test_list_trusted():
+    """
+    Tests that list_trusted returns all trusted items as a dict.
+    """
+    expected = {
+        "taps": ["thirdparty/foo"],
+        "formulae": ["thirdparty/foo/bar"],
+        "casks": [],
+        "commands": [],
+    }
+    mock_call_brew = MagicMock(
+        return_value={
+            "retcode": 0,
+            "stdout": '{"taps": ["thirdparty/foo"], "formulae": ["thirdparty/foo/bar"], "casks": [], "commands": []}',
+            "stderr": "",
+        }
+    )
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.list_trusted() == expected
+        mock_call_brew.assert_called_once_with("trust", "--json=v1")
+
+
+def test_list_trusted_by_type():
+    """
+    Tests that list_trusted with a type returns a list of trusted items.
+    """
+    mock_call_brew = MagicMock(
+        return_value={
+            "retcode": 0,
+            "stdout": '["thirdparty/foo"]',
+            "stderr": "",
+        }
+    )
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.list_trusted(type="tap") == ["thirdparty/foo"]
+        mock_call_brew.assert_called_once_with("trust", "--json=v1", "--tap")
+
+
+def test_list_trusted_invalid_type():
+    """
+    Tests that list_trusted raises SaltInvocationError for an invalid type.
+    """
+    with pytest.raises(
+        salt.exceptions.SaltInvocationError, match="Invalid type 'invalid'"
+    ):
+        mac_brew.list_trusted(type="invalid")
+
+
+# 'trust' function tests
+
+
+def test_trust():
+    """
+    Tests successfully trusting a tap.
+    """
+    mock_call_brew = MagicMock(return_value={"retcode": 0, "stdout": "", "stderr": ""})
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.trust("thirdparty/foo") is True
+        mock_call_brew.assert_called_once_with("trust", "thirdparty/foo")
+
+
+def test_trust_with_type():
+    """
+    Tests trusting an item with an explicit type flag.
+    """
+    mock_call_brew = MagicMock(return_value={"retcode": 0, "stdout": "", "stderr": ""})
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.trust("thirdparty/foo", type="tap") is True
+        mock_call_brew.assert_called_once_with("trust", "--tap", "thirdparty/foo")
+
+
+def test_trust_failure():
+    """
+    Tests that trust returns False when brew trust fails.
+    """
+    mock_call_brew = MagicMock(side_effect=CommandExecutionError("brew failed"))
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.trust("thirdparty/foo") is False
+
+
+def test_trust_invalid_type():
+    """
+    Tests that trust raises SaltInvocationError for an invalid type.
+    """
+    with pytest.raises(
+        salt.exceptions.SaltInvocationError, match="Invalid type 'invalid'"
+    ):
+        mac_brew.trust("thirdparty/foo", type="invalid")
+
+
+# 'untrust' function tests
+
+
+def test_untrust():
+    """
+    Tests successfully untrusting a tap.
+    """
+    mock_call_brew = MagicMock(return_value={"retcode": 0, "stdout": "", "stderr": ""})
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.untrust("thirdparty/foo") is True
+        mock_call_brew.assert_called_once_with("untrust", "thirdparty/foo")
+
+
+def test_untrust_with_type():
+    """
+    Tests untrusting an item with an explicit type flag.
+    """
+    mock_call_brew = MagicMock(return_value={"retcode": 0, "stdout": "", "stderr": ""})
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.untrust("thirdparty/foo/bar", type="formula") is True
+        mock_call_brew.assert_called_once_with(
+            "untrust", "--formula", "thirdparty/foo/bar"
+        )
+
+
+def test_untrust_failure():
+    """
+    Tests that untrust returns False when brew untrust fails.
+    """
+    mock_call_brew = MagicMock(side_effect=CommandExecutionError("brew failed"))
+    with patch("salt.modules.mac_brew_pkg._call_brew", mock_call_brew):
+        assert mac_brew.untrust("thirdparty/foo") is False
+
+
+def test_untrust_invalid_type():
+    """
+    Tests that untrust raises SaltInvocationError for an invalid type.
+    """
+    with pytest.raises(
+        salt.exceptions.SaltInvocationError, match="Invalid type 'invalid'"
+    ):
+        mac_brew.untrust("thirdparty/foo", type="invalid")
+
+
+# 'is_trusted' function tests
+
+
+def test_is_trusted_found():
+    """
+    Tests is_trusted returns True when the item is in the trusted list.
+    """
+    trusted = {
+        "taps": ["thirdparty/foo"],
+        "formulae": [],
+        "casks": [],
+        "commands": [],
+    }
+    with patch("salt.modules.mac_brew_pkg.list_trusted", return_value=trusted):
+        assert mac_brew.is_trusted("thirdparty/foo") is True
+
+
+def test_is_trusted_not_found():
+    """
+    Tests is_trusted returns False when the item is not trusted.
+    """
+    trusted = {
+        "taps": [],
+        "formulae": [],
+        "casks": [],
+        "commands": [],
+    }
+    with patch("salt.modules.mac_brew_pkg.list_trusted", return_value=trusted):
+        assert mac_brew.is_trusted("thirdparty/foo") is False
+
+
+def test_is_trusted_with_type():
+    """
+    Tests is_trusted with a type filter delegates to list_trusted with that type.
+    """
+    with patch(
+        "salt.modules.mac_brew_pkg.list_trusted", return_value=["thirdparty/foo"]
+    ) as mock_list:
+        assert mac_brew.is_trusted("thirdparty/foo", type="tap") is True
+        mock_list.assert_called_once_with(type="tap")
+
+
+def test_is_trusted_with_type_not_found():
+    """
+    Tests is_trusted with a type filter returns False when not in list.
+    """
+    with patch(
+        "salt.modules.mac_brew_pkg.list_trusted", return_value=["other/tap"]
+    ):
+        assert mac_brew.is_trusted("thirdparty/foo", type="tap") is False