nanobrew v0.1.198

Byte-identical copies of all 231 Homebrew bottles we already pin, four platforms each. Digests are unchanged, so existing registry records work against the mirror with zero edits. This is insurance against upstream garbage-collection, renames, and outages. One env var, NANOBREW_BOTTLE_DOMAIN=https://ghcr.io/v2/justrach/nb-bottles, moves the whole fleet over.

Upstream github_release binaries (ripgrep, fd, bat, jq, gh, and friends) re-laid into bottle form and published under our namespace. They carry no Homebrew placeholders, so the relocate phase does nothing and they get the fastest install path nanobrew has: blob cache, store, copy-on-write materialize, link. These pull from our registry by default.

A metadata mirror is not independence. The bottle, the bytes you actually install and run, is the real dependency. For covered packages, those bytes now come from infrastructure we control, digest-verified identical to what Homebrew pins. Homebrew's bottle host can go down and your covered installs keep working.

syft builds an SBOM for each pinned bottle (all four platforms, Linux included), grype matches it against CVE data, and the job fails at or above the gate (default high). The first full run already caught a real one: gh 2.91.0 ships a Go 1.26.2 standard library with HIGH-severity CVEs.

revoke marks a bad pin and records the previous known-good version as a fallback. The resolver then installs that fallback and prints a warning naming the advisory; a revoked pin with no fallback fails closed. No binary release is needed, since revocations propagate through the registry in about six hours. nb doctor flags any machine that already installed a now-revoked version, with the exact fix.

attest ranks each upstream asset by the strongest vouching available (github-attestation, then checksum-file, then pin-only) and dies on any disagreement with upstream's published checksums. Version tags are immutable: a different blob can never be re-tagged under an existing version. SBOMs and scan reports ride along on each bottle's GHCR manifest as OCI referrer artifacts, so anyone can inspect a bottle's record without trusting our CI logs.

Linux relocation is now native and in-place instead of shelling out to patchelf. A short /opt/nb symlink makes every @@HOMEBREW_*@@ replacement shorter than its placeholder, so RPATH/RUNPATH, DT_NEEDED, PT_INTERP, and .rodata strings are all rewritten in one pass. No subprocesses, and no apt-get install patchelf bootstrap, which alone cost about 4.8s on every fresh machine and made installs fail where no package manager existed.

Resolving any package outside the verified-upstream registry used to re-download the roughly 650KB registry from GitHub on every resolve. A fresh registry cache is now authoritative for misses too, and a fetched registry is cached even when the requested token is not in it, so non-registry resolves stop re-paying the remote fetch on every call.

The batch-shared GHCR bearer token was being fetched whenever any package had a ghcr.io bottle URL, even when every blob was already in the local cache. It is now fetched only when at least one bottle actually needs downloading.

A native post-install step wires cert.pem for brewed openssl/gnutls so TLS verification works on fresh Linux machines · @@HOMEBREW_PERL@@ shebangs are relocated so perl-backed tools run · download retries are hardened with a transient-only whitelist and per-worker tmp paths · NB_BENCH=1 now reports per-phase timings (extract, materialize, relocate, link, postinstall) for each package.