fix(update): trust azure/azd Homebrew cask source so macOS update banner and azd update work#8776
Merged
Merged
Conversation
hemarina
requested review from
JeffreyCA,
RickWinter,
tg-msft and
vhvb1989
as code owners
Contributor
Author
|
@alexwolfmsft Could we also update the commands in blogs? |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a macOS/Homebrew regression where Homebrew treats the azure/azd tap as untrusted, causing azd’s update banner guidance and azd update’s Homebrew path to suggest/run cask commands that fail until the tap is trusted.
Changes:
- Updates macOS Homebrew install/update instructions to include a trust prerequisite for the
azure/azdtap. - Adds a best-effort Homebrew trust step in
azd update’s brew-based updater to unblock cask operations. - Updates tests and design docs to reflect the new Homebrew trust behavior, and documents the fix in the changelog.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adjusts macOS install command and notes to address Homebrew untrusted tap behavior. |
| cli/installer/README.md | Mirrors the macOS Homebrew trust prerequisite in installer documentation. |
| cli/azd/pkg/update/manager.go | Adds a Homebrew trust step before performing cask operations in azd update. |
| cli/azd/pkg/update/manager_test.go | Updates brew update tests to mock the new trust behavior and verify best-effort semantics. |
| cli/azd/main.go | Updates the macOS update banner hint for Homebrew installs to include tap trust guidance. |
| cli/azd/main_test.go | Updates banner expectation for the revised Homebrew hint. |
| cli/azd/docs/design/azd-update.md | Documents the Homebrew trust prerequisite in the azd update design. |
| cli/azd/CHANGELOG.md | Records the user-visible fix in the changelog. |
Ensure `brew trust azure/azd` runs before any brew install/upgrade/uninstall of the azd cask so Homebrew's untrusted-source guard doesn't block it: reorder the macOS update banner to trust first (fixes TestPlatformUpgradeHintFor, which expects the trust-first one-liner) and prefix PackageManagerUninstallCmd (brew) with `brew trust azure/azd`. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
hemarina
changed the title
Collaborator
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
jongio
reviewed
Jun 24, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Clean fix. The best-effort brew trust before cask operations handles both the current Homebrew guard and older versions without it. TrustFails_StillUpgrades test confirms graceful degradation. Docs, banner, and azd update path are all updated consistently. LGTM.
vhvb1989
approved these changes
Jun 24, 2026
Copilot AI
added a commit
that referenced
this pull request
Jun 25, 2026
Co-authored-by: hemarina <104857065+hemarina@users.noreply.github.com>
tg-msft
pushed a commit
that referenced
this pull request
Jun 25, 2026
* Initial plan * Prepare azd 1.26.0 release * Add PR 8785 to 1.26.0 changelog * Add #8776 (Homebrew trust fix) to 1.26.0 changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #8683
Problem
On macOS, the
azdupdate banner suggests a Homebrew command that fails:Homebrew treats the third-party
azure/azdsource as untrusted and blocksevery operation that reads its cask metadata — install, upgrade, and even
uninstall — until it is trusted with
brew trust azure/azd. The banner sendsusers in a circle, and
azd update's Homebrew path (updateViaBrew) runs thesame blocked cask commands.
Fix
Keep azd on its existing
azure/azdHomebrew cask and runbrew trust azure/azdbefore any cask install/upgrade/uninstall so the commands aren'tblocked by Homebrew's untrusted-source guard.
We verified by testing that a separate
brew tapstep isn't needed:brew trustrecords trust against the source name (
azure/azd) as durable Homebrew state(it even survives
brew untap), sobrew trust azure/azd && brew install --cask azure/azd/azdworks on its own — the install resolves the now-trusted source.cli/azd/main.go): now suggestsbrew trust azure/azd && brew uninstall azd && brew install --cask azure/azd/azd.brew trustrunsfirst so even the
uninstall— which also reads cask metadata and isotherwise blocked — succeeds.
azd update(cli/azd/pkg/update/manager.go):updateViaBrewrunsbrew trust azure/azdbefore any cask install/upgrade/uninstall (stable anddaily). Best-effort and idempotent, so older Homebrew without the untrusted-
source guard (and therefore without a
brew trustcommand) still works.PackageManagerUninstallCmd: the brew uninstall hint is nowbrew trust azure/azd && brew uninstall azd.README.md,cli/installer/README.md): updated tobrew trust azure/azd && brew install --cask azure/azd/azd.Testing
main_test.godarwin/brew banner expectation andTestPackageManagerUninstallCmdupdated to the trust-first commands.
TestUpdateViaBrewsub-tests mock thebrew trust azure/azdstep, andTrustFails_StillUpgradesproves a trust failure does not abort the update.go build ./...,go test ./go test ./pkg/update/...,golangci-lint,gofmt, andgo vetare clean.Notes
installer.InstalledBy()only returnsInstallTypeBrew(it can't distinguish acask install from a formula install), so the banner targets the cask path.