From b317dc0605b6007d689f314e23829f7403fdbff3 Mon Sep 17 00:00:00 2001 From: Zack Whitson Date: Fri, 7 Aug 2026 02:43:29 -0500 Subject: [PATCH] Update Homebrew formula to CodeTruss CLI v0.2.37 The tap served 0.2.36 while the website and the newest attested release served 0.2.37. url and sha256 come from the immutable v0.2.37 GitHub release, not the website copy. Verified they are the same bytes: the downloaded release asset, the archive on codetruss.com (both `codetruss-cli-latest.tgz` and the versioned `codetruss-cli-0.2.37.tgz`), and a rebuild from the tagged source in CI all hash to 082a03fe5dd2d9c516acc76504e0bb45bc7d3b5a1fa7308fb2d627ce07a3c627. `gh attestation verify` binds that digest to release.yml at refs/tags/v0.2.37, tag commit f420be17b5b886fb54b4901afb929665c0549ba3, on a GitHub-hosted runner (exit 0 with --signer-workflow, --source-ref, --source-digest and --deny-self-hosted-runners all pinned). The verifier was falsification-checked rather than trusted: a flipped byte, a wrong source-ref, a wrong source-digest, a wrong signer workflow and a wrong repository each exit 1, with exit codes captured directly rather than through a pipeline. The workflow's post-install assertion is version-pinned, so it moves with the formula. Leaving it at 0.2.36 would have failed the install test on both macOS legs. Co-Authored-By: Claude Fable 5 --- .github/workflows/test.yml | 2 +- Formula/codetruss.rb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d5a0923..9d3e570 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -51,4 +51,4 @@ jobs: run: | brew install --build-from-source DeliriumPulse/codetruss/codetruss brew test DeliriumPulse/codetruss/codetruss - test "$(codetruss --version)" = "codetruss 0.2.36" + test "$(codetruss --version)" = "codetruss 0.2.37" diff --git a/Formula/codetruss.rb b/Formula/codetruss.rb index f440cc4..12cc653 100644 --- a/Formula/codetruss.rb +++ b/Formula/codetruss.rb @@ -1,8 +1,8 @@ class Codetruss < Formula desc "Deterministic first-pass verification gate for AI-written code" homepage "https://codetruss.com/cli" - url "https://github.com/DeliriumPulse/codetruss-cli/releases/download/v0.2.36/codetruss-cli-0.2.36.tgz" - sha256 "953e3f48725a7471043b48a55aedd33ef78854615a341dd95881d90eeae3e814" + url "https://github.com/DeliriumPulse/codetruss-cli/releases/download/v0.2.37/codetruss-cli-0.2.37.tgz" + sha256 "082a03fe5dd2d9c516acc76504e0bb45bc7d3b5a1fa7308fb2d627ce07a3c627" license :cannot_represent depends_on "node"