Repository navigation
Don't retry rate-limited attestation lookups - #24433
Conversation
- A rate-limited `gh attestation verify` was classified as an `InvalidAttestationError`, retried five times with 121s of sleeps and reported as a possibly malicious bottle. - Raise `RateLimitExceededError` for HTTP 403/429 responses carrying GitHub's primary or secondary rate limit wording, skip the retries and fail the install with a message naming the rate limit. - `brew verify` rescues the new error and reports it per bottle. Signed-off-by: Patrick Linnane <patrick@linnane.io>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Classify rate-limit responses Library/Homebrew/attestation.rb, Library/Homebrew/test/attestation_spec.rb |
Defines a distinct error for recognised HTTP 403 or 429 rate-limit responses. Tests distinguish these responses from other errors. |
Handle rate limits during formula installation Library/Homebrew/utils/attestation.rb, Library/Homebrew/test/attestation_spec.rb |
Converts the rate-limit error to a formula installation error with a retry-later message. Tests cover the message and no-retry behaviour, including backfill lookup. |
Handle rate limits in the verify command Library/Homebrew/dev-cmd/verify.rb, Library/Homebrew/test/dev-cmd/verify_spec.rb |
Adds the rate-limit error to the command’s failure handling. The test checks stderr output and that Homebrew.failed is set to true. |
Merge Risk: 
ece82
-
No merge-blocking issue is identified in the supplied evidence.
Pre-merge checks: 
-
Check name Status Explanation Title check The title states the main change: rate-limited attestation lookups are no longer retried. The raw summary confirms that HTTP 403 and 429 rate-limit responses now raise RateLimitExceededError, which sk… Description check The description explains the problem and the fix. A rate-limited gh attestation verify was misclassified as InvalidAttestationError and retried five times. HTTP 403 and 429 responses with rate-limit w… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title states the main change: rate-limited attestation lookups are no longer retried. The raw summary confirms that HTTP 403 and 429 rate-limit responses now raise RateLimitExceededError, which skips retries and fails the install. The title is specific and accurate.
Full details: Description check
-
Explanation
The description explains the problem and the fix. A rate-limited gh attestation verify was misclassified as InvalidAttestationError and retried five times. HTTP 403 and 429 responses with rate-limit wording now raise RateLimitExceededError, and brew verify rescues the new error. This matches the raw summary and the objectives. The description also lists testing and AI-use disclosures.
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
|
Makes sense, thanks! |
A rate-limited
gh attestation verifywas classified as anInvalidAttestationError, retried five times with 121s of sleeps per bottle and then reported as a possibly malicious bottle, which wasted CI runner time and described a quota problem as a provenance failure. HTTP 403 and 429 responses carrying GitHub's primary or secondary rate limit wording now raiseRateLimitExceededError, which skips the retries and fails the install with a message naming the rate limit.brew verifyrescues the new error and reports it per bottle.brew benchmarkresults.brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Codex (GPT-6 Astra) wrote the initial change and tests. Claude Code (Fable 5.1) reviewed it against the
gh2.103.3 attestation client, added the secondary rate limit wording and thebrew verifyrescue, checked that each of its new examples fails without its change and ranbrew lgtmon the final commit.