brew bundle cleanup untrusts previously trusted taps, etc

[vraravam]

brew doctor output

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  mechvibes

Warning: The following taps are not trusted:
  vorssaint/tap
  xykong/tap

Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required.
Prefer trusting only the specific formulae, casks or commands you need.
Trust installed casks from these taps with:
  brew trust --cask vorssaint/tap/vorssaint
  brew trust --cask xykong/tap/flux-markdown
Trust other specific formulae and commands with:
  brew trust --formula <user>/<tap>/<formula>
  brew trust --command <user>/<tap>/<command>
Whole-tap trust is broader and includes all current and future formulae,
casks and commands from the listed taps. Trust whole taps with:
  brew trust vorssaint/tap xykong/tap
Untap them with:
  brew untap vorssaint/tap xykong/tap
For more information, see:
  https://docs.brew.sh/Tap-Trust

Verification

• I ran brew update twice and am still able to reproduce my issue.
• My "brew doctor output" above says Your system is ready to brew or a definitely unrelated Tier message.
• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

brew config output

HOMEBREW_VERSION: 6.0.2-118-g79c3772
ORIGIN: https://github.com/Homebrew/brew
HEAD: 79c3772f68f8d0688f477e381f5c824cf557cf8b
Last commit: 75 minutes ago
Branch: main
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_BAT: set
HOMEBREW_CASK_OPTS: []
HOMEBREW_CLEANUP_MAX_AGE_DAYS: 3
HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS: 3
HOMEBREW_DOWNLOAD_CONCURRENCY: 24
HOMEBREW_EDITOR: wait-editor
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_NO_ANALYTICS: set
HOMEBREW_NO_ENV_HINTS: set
HOMEBREW_REQUIRE_TAP_TRUST: set
HOMEBREW_VERBOSE_USING_DOTS: set
Homebrew Ruby: 4.0.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5_1/bin/ruby
CPU: dodeca-core 64-bit arm_lobos
Clang: 21.0.0 build 2100
Git: 2.54.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.6-arm64
CLT: 27.0.0.0.1780650213
Xcode: N/A
Rosetta 2: false

What were you trying to do (and why)?

brew bundle check -v 2>/dev/null || brew bundle install -q 2>/dev/null || true

Trust any newly-untrusted items from newly-tapped taps (brew bundle may have installed new taps)

trust_brewfile_items

Second pass: install newly-trusted formulae/casks (idempotent if nothing new to trust)

brew bundle check -v || brew bundle install -q || true

brew bundle cleanup -f || true
brew cleanup --prune=all || true
brew autoremove || true
brew upgrade || true

What happened (include all command output)?

The formulae/casks that were trusted in the custom shell function (trust_brewfile_items) became untrusted after brew bundle cleanup -f ran.

What did you expect to happen?

The trusted taps/formulae/casks remained trusted

Step-by-step reproduction instructions (running brew commands)

1. Add a new 3rd party tap and a cask from there into Brewfile.
2. run the above sequence of commands

[vraravam]

Adding a screenshot of the repeated trusting step - notice that it doesn't say "already trusted".

[MikeMcQuaid]

What's the contents of your Brewfile? It is expected that brew bundle cleanup may untrust taps by design.

[vraravam]

Brewfile

and the function to trust: https://github.com/vraravam/dotfiles/blob/990241b0499a393c49330f143dea56d7fdcdb112/files/--HOME--/.aliases#L690

[vraravam]

I was thinking a bit more about this, and the following Brewfile should be enough to reproduce this bug:

tap 'vorssaint/tap'
cask 'vorssaint'

Run the following commands in sequence:

brew trust vorssaint/tap
brew bundle install
brew doctor # should not show untrusted
brew bundle cleanup -f
brew doctor # will show untrusted

[MikeMcQuaid]

You need to add the trust lines into your Brewfile. In general brew bundle cleanup should be guaranteed to be a no-op only on a brew bundle dump'd Brewfile.

[vraravam]

--Is there any documentation of the Brewfile DSL so that I can trust within there itself? I searched for it, but couldn't find it--

Got it ! Thanks!

[vraravam]

Thanks @MikeMcQuaid - based your trick of brew bundle dumping, I was able to find out the trusted: true option. Now, I have simplified my Brewfile and removed that custom function completely!

[MikeMcQuaid]

@vraravam Glad it worked, you're welcome.