bin/brew: tighten check in export_homebrew_env_file

[carlocab]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

The current glob check will accept lines like

HOMEBREW_FOO=bar BAD_ENV_VAR=baz

and happily export them, but we don't want that.

Let's tighten up the check to reject lines like the above.

[carlocab]

Ideally we should be able to reject spaces after the =, but we have a lot of env variables that take multiple values that are space-separated.

Personally I'd be in favour of deprecating separating these with spaces and delimit them with , or ; instead.

[MikeMcQuaid]

I'd rather we did't deprecate for this. An alternative approach would be to "build" the line separately by extracting first the HOMEBREW_[A-Z_]+, then the =, then the rest of the line without = or HOMEBREW_ in it.

[MikeMcQuaid]

Looks good! Happy to merge as-is and iterate.

[ctaintor]

this has broken our organization's usage of setting a custom HOMEBREW_ARTIFACT_DOMAIN. We have to override HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN to be anonymous:anonymous which, when base64 encoded, has the line end in =.

Can this PR be reverted? The effect of this means that the auth token isn't set, which then means that Homebrew will add --header Authorization:\ Bearer\ QQ== which will then cause our mirror to return 401

HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN=YW5vbnltb3VzOmFub255bW91cw==

[ctaintor]

Opened #18110

[ctaintor]

just an idea how you might want to do what you were doing

#!/bin/bash

# Define the input and output dotfiles
input_dotfile="/etc/homebrew/brew.env"
output_dotfile="sanitized.env"
before_vars="" #initializing the variable so it doesn't show as "new"

pattern="^HOMEBREW_[A-Z_]*="

before_vars=$(compgen -v)

source "$input_dotfile"

after_vars=$(compgen -v)

# Get the difference: variables that are in after_vars but not in before_vars
new_vars=$(comm -13 <(echo "$before_vars" | sort) <(echo "$after_vars" | sort))

# Filter and save only the variables matching the pattern
>| $output_dotfile
for var in $new_vars; do
    value=$(eval echo \$$var)
    if [[ "$var=$value" =~ $pattern ]]; then
        echo "$var=$value" >> "$output_dotfile"
    fi
done

echo "Filtered variables have been saved to $output_dotfile"

[MikeMcQuaid]

@ctaintor Could you try and open a pull request? This document should help and we're happy to walk you through anything else.

Thanks!