[MikeMcQuaid]

• Keep the warning in macOS brew doctor checks.
• Reuse Homebrew's running Ruby under sudo to parse certificates without a shell launcher or assumptions about bundle headings.
• Preserve a backup before atomically replacing the trust bundle.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1f992904-9036-434b-94af-96c9e0e54c3e

Commits

Reviewing files that changed from the base of the PR and between c6b300a and c2b4005.

Files selected for processing: 4

• Library/Homebrew/diagnostic.rb
• Library/Homebrew/extend/os/mac/diagnostic.rb
• Library/Homebrew/test/diagnostic/emudhra_certificates_spec.rb
• Library/Homebrew/utils/emudhra_certificates.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Summary

Summary by CodeRabbit

• Security
  • Added a brew doctor warning when either affected eMudhra certificate root is trusted, with an advisory link and remediation guidance.
  • Added a macOS-only script for administrators to remove the affected roots from the system certificate bundle. It preserves other certificates, creates backups and provides restore instructions.
• Tests
  • Added coverage for certificate detection and removal, backup handling, and failure conditions.

The change adds a macOS diagnostic for two certificate roots in /etc/ssl/cert.pem and a script that removes them. It also adds an OpenSSL RBI declaration and tests for diagnostic and script behaviour.

Changes: eMudhra certificate handling

Layer / File(s)	Summary
Certificate detection and diagnostic Library/Homebrew/diagnostic.rb, Library/Homebrew/extend/os/mac/diagnostic.rb, Library/Homebrew/sorbet/rbi/shims/openssl.rbi, Library/Homebrew/test/diagnostic/emudhra_certificates_spec.rb	The diagnostic loads certificates from the bundle and reports a finding when either named root is present. The macOS check skips GitHub Actions environments. The OpenSSL shim declares the certificate loader. Tests cover detection, remediation text, and missing or invalid bundles.
Certificate bundle removal Library/Homebrew/utils/emudhra_certificates.rb, Library/Homebrew/test/diagnostic/emudhra_certificates_spec.rb	The script filters the named roots, stages the remaining certificates and backups, preserves the first original backup, refreshes the regular backup, and replaces the bundle. Tests cover execution restrictions, backup and replacement behaviour, invalid inputs, and failure handling.

Priority: Low

Merge Risk: Minimal · up to c2b40

The previously identified bundle-replacement risks are addressed, and no actionable merge-blocking issue remains after normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely summarises the main change: detecting and mitigating eMudhra certificate trust issues.
Description check		The description is related to the changeset. It explains the diagnostic warning, certificate parsing, trust-bundle replacement, backup behaviour, testing, and verification.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ca2fd7cf-066e-4fb1-8ce0-98d6ae743329

Commits

Reviewing files that changed from the base of the PR and between 3ef701b and c6b300a.

Files selected for processing: 4

• Library/Homebrew/extend/os/mac/diagnostic.rb
• Library/Homebrew/sorbet/rbi/shims/openssl.rbi
• Library/Homebrew/test/diagnostic/emudhra_certificates_spec.rb
• Library/Homebrew/utils/emudhra_certificates.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[ZhongRuoyu]

macOS CI failed because GitHub runners still trust them 😭

[p-linnane]

This is a great idea!