diff --git a/docs/Homebrew/Attestation.html b/docs/Homebrew/Attestation.html index 49fad1b4b..b21fc12ec 100644 --- a/docs/Homebrew/Attestation.html +++ b/docs/Homebrew/Attestation.html @@ -464,7 +464,21 @@

110 111 112 -113 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 
# File 'attestation.rb', line 74
@@ -501,8 +515,22 @@ 

   # for all attestations that match the input's digest. We want to additionally
   # filter these down to just the attestation whose subject matches the bottle's name.
   subject = bottle.filename.to_s if subject.blank?
-  attestation = attestations.find do |a|
-    a.dig("verificationResult", "statement", "subject", 0, "name") == subject
+
+  attestation = if bottle.tag.to_sym == :all
+    # :all-tagged bottles are created by `brew bottle --merge`, and are not directly
+    # bound to their own filename (since they're created by deduplicating other filenames).
+    # To verify these, we parse each attestation subject and look for one with a matching
+    # formula (name, version), but not an exact tag match.
+    # This is sound insofar as the signature has already been verified. However,
+    # longer term, we should also directly attest to `:all`-tagged bottles.
+    attestations.find do |a|
+      actual_subject = a.dig("verificationResult", "statement", "subject", 0, "name")
+      actual_subject.start_with? "#{bottle.filename.name}--#{bottle.filename.version}"
+    end
+  else
+    attestations.find do |a|
+      a.dig("verificationResult", "statement", "subject", 0, "name") == subject
+    end
   end
 
   raise InvalidAttestationError, "no attestation matches subject" if attestation.blank?
@@ -609,20 +637,6 @@ 

       
 
 
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
 140
 141
 142
@@ -655,10 +669,24 @@ 

 169
 170
 171
-172

+172
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183
+184
+185
+186
- 
# File 'attestation.rb', line 126
+      
# File 'attestation.rb', line 140
 
 def self.check_core_attestation(bottle)
   begin