diff --git a/Library/Homebrew/attestation.rb b/Library/Homebrew/attestation.rb index dea08de3c4..21737a9241 100644 --- a/Library/Homebrew/attestation.rb +++ b/Library/Homebrew/attestation.rb @@ -119,14 +119,14 @@ module Homebrew url_sha256 = Digest::SHA256.hexdigest(bottle.url) subject = "#{url_sha256}--#{bottle.filename}" - # We don't pass in a signing worfklow for backfill signatures because - # some backfilled bottle signatures were signed from a branch, and others - # from main, so the signing workflow is slightly different which causes - # some bottles to incorrectly fail when checking their attestation. - # This shouldn't meaningfully affect security because if somehow someone - # could generate false backfill attestations from a different workflow - # we will still catch it because the attestation would have been - # generated after our cutoff date. + # We don't pass in a signing workflow for backfill signatures because + # some backfilled bottle signatures were signed from the 'backfill' + # branch, and others from 'main', so the signing workflow is slightly + # different which causes some bottles to incorrectly fail when checking + # their attestation. This shouldn't meaningfully affect security + # because if somehow someone could generate false backfill attestations + # from a different workflow we will still catch it because the + # attestation would have been generated after our cutoff date. backfill_attestation = check_attestation bottle, BACKFILL_REPO, nil, subject timestamp = backfill_attestation.dig("verificationResult", "verifiedTimestamps", 0, "timestamp")