anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
6.04k stars 555 forks source link

Verify brew installations on/before release #576

Open wagoodman opened 2 years ago

wagoodman commented 2 years ago

What would you like to be added: Do one of the following:

Why is this needed: We recently ran into a problem with goreleaser where the checksums of the asset referenced in the brew formula was wrong, preventing installations. The first indication of a problem was when users begin to report problems in slack and issues. It would be ideal to prevent this by testing before the release or at the very least get notified on slack after a release if a validation fails.

Related to #519

jonasagx commented 2 years ago

It would great to have it tested/verified in a CI box running macOS, or maybe linux since Homebrew supports linux