[release/13.5] Fix deprecated Homebrew cask DSL usage

[Jose Perez Rodriguez (joperezr)]

Description

Backport of #19965 to release/13.5, cherry-picked from 12847d472bd65282485fd102d449077e0bd66ff3.

Homebrew 6.x rejects the deprecated verified: cask URL parameter, blocking Homebrew validation on release-branch builds (including #20094 and #20110). This preserves the complete source fix: remove verified:, migrate postflight/File.write to postflight_steps/write_file, simplify dogfood URL rewriting, and remove obsolete brew audit --signing/--no-signing arguments.

Conflict resolutions

• Omit main-only .github/workflows/homebrew-validate-release.yml; retain release/13.5's Azure DevOps HomebrewValidateJob and update both relevant pipeline comments.
• Resolve docs/release-process.md and eng/homebrew/README.md using the release branch's existing orchestration, documenting the updated audit and explicit notarization gate without importing main's release-process migration.
• Template, dogfood script, and regression tests match the source commit. The validation script differs only in its retained HomebrewValidateJob comment.

Security considerations

Preserves release-binary signature/notarization validation explicitly with codesign --verify -R=notarized --check-notarization on the installed Caskroom binary. Homebrew no longer runs its signing audit automatically for our temporary third-party tap. A failed notarization check remains fatal and invokes the existing uninstall/cleanup path. Regression coverage for invocation and failure cleanup is included; actual macOS verification was not run on this Windows host.

Fixes # (issue)

Customer Impact

Unblocks Homebrew cask preparation/validation for release/13.5 with current Homebrew, while preserving install-channel metadata and the release notarization gate. No public API changes.

Testing

• Rebased onto release/13.5 tip bd4a8e2efccc86a00ba9ff0df890a326f0318146.
• Acquisition test project built; PRScriptInstallerModeTests: 11 Windows-compatible tests passed, 0 failed.
• Homebrew Bash tests are platform-excluded on Windows. A focused selection ran zero tests; these are not claimed as passing.
• Git Bash bash -n passed for dogfood.sh, validate-cask-artifact.sh, and prepare-cask-artifact.sh.
• git diff --check passed.
• Real macOS Homebrew style/audit/install/notarization validation remains for CI/macOS. The source PR records successful Homebrew validation, but that is not release-branch validation.

Risk

Low: scoped to Homebrew packaging/validation, related tests, and documentation. Existing release orchestration and cleanup behavior are retained. Real Homebrew/macOS execution remains the principal validation gap.

Regression?

Compatibility regression with current Homebrew: release PR #19998 passed September 9, while #20094 and #20110 failed September 13–14 on the deprecated verified parameter. No specific Aspire-introduced regression has been identified.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20119

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20119"

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

2 / 100 test projects · 3 jobs, from 5 changed files.

Selected test projects (2 / 100)

Aspire.Acquisition.Tests, Infrastructure.Tests

Selected jobs (3)

cli-starter, homebrew-installer, winget-installer

---

How these were chosen — grouped by what changed

📄 eng/homebrew/aspire.rb.template (changed)
→ 1 directly: Aspire.Acquisition.Tests

📄 eng/homebrew/dogfood.sh (changed)
→ 1 directly: Aspire.Acquisition.Tests

📄 eng/homebrew/validate-cask-artifact.sh (changed)
→ 1 directly: Aspire.Acquisition.Tests

📄 eng/pipelines/release-publish-nuget.yml (changed)
→ 1 directly: Infrastructure.Tests

🧪 tests/Aspire.Acquisition.Tests/Scripts/PRScriptInstallerModeTests.cs (changed test)
→ 1 directly: Aspire.Acquisition.Tests

Job reasons

Job	Triggered by
cli-starter	selected test Aspire.Acquisition.Tests
homebrew-installer	• eng/homebrew/aspire.rb.template, eng/homebrew/dogfood.sh, eng/homebrew/validate-cask-artifact.sh • selected test Aspire.Acquisition.Tests
winget-installer	selected test Aspire.Acquisition.Tests

---

Selection computed for commit 83a54a9.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation and regression coverage are sound; remaining feedback concerns minor inaccuracies in the validation rationale.

Review tier: Balanced
Findings: 2

Open findings (2)

• Remove the inactive signing audit from this explanation · New
• Remove signing from the LiveArchives summary · New

What changed in this PR

Backports Homebrew 6 compatibility fixes to release/13.5 while preserving release notarization validation.

Changes:

• Migrates the cask template to current Homebrew DSL.
• Updates audit flags and adds explicit notarization verification.
• Updates release documentation and regression tests.

File	Description
eng/​homebrew/​aspire.rb.template	Updates deprecated cask DSL.
eng/​homebrew/​dogfood.sh	Simplifies local URL rewriting.
eng/​homebrew/​validate-cask-artifact.sh	Revises audits and verifies notarization.
eng/​homebrew/​README.md	Documents validation modes.
eng/​pipelines/​release-publish-nuget.yml	Updates release-pipeline comments.
docs/​release-process.md	Documents the notarization gate.
tests/​Aspire.Acquisition.Tests/​Scripts/​PRScriptInstallerModeTests.cs	Covers audit and notarization behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch taken: excluded → base_branch_is_release, title_release_prefix, body_backport_marker.

This PR is a backport of #19965 to release/13.5 (title prefixed [release/13.5], base branch is release/13.5, and the body explicitly states "Backport of #19965 to release/13.5, cherry-picked from 12847d472bd65282485fd102d449077e0bd66ff3"). Per the exclusion rule, backport PRs are out of scope for docs generation since their user-facing documentation is authored against the original (forward) PR on the default branch — drafting a second docs PR here would be duplicate noise.

Triggered signals (2, both from pr_body_has_cli_flag_mention and pr_body_has_deprecation_marker) relate to Homebrew's own deprecated verified: cask DSL parameter and brew audit --signing flags — internal packaging/build tooling concerns, not Aspire user-facing surface — but this is moot since the excluded flag overrides the recommendation regardless.

No documentation PR was drafted.