{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/brew/issues/241","repository_url":"https://api.github.com/repos/Homebrew/brew","labels_url":"https://api.github.com/repos/Homebrew/brew/issues/241/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/brew/issues/241/comments","events_url":"https://api.github.com/repos/Homebrew/brew/issues/241/events","html_url":"https://github.com/Homebrew/brew/pull/241","id":154779364,"number":241,"title":"certs: add certificates update cmd","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Homebrew/brew/labels/discussion","name":"discussion","color":"006b75"},{"url":"https://api.github.com/repos/Homebrew/brew/labels/features","name":"features","color":"dddddd"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-13T19:02:16Z","updated_at":"2016-05-13T21:48:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Homebrew/brew/pulls/241","html_url":"https://github.com/Homebrew/brew/pull/241","diff_url":"https://github.com/Homebrew/brew/pull/241.diff","patch_url":"https://github.com/Homebrew/brew/pull/241.patch"},"body":"- [x] Have you followed the guidelines in our [Contributing](https://github.com/Homebrew/brew/blob/master/.github/CONTRIBUTING.md) document?\r\n- [x] Have you checked to ensure there aren't other open [Pull Requests](https://github.com/Homebrew/brew/pulls) for the same change?\r\n- [x] Have you added an explanation of what your changes do and why you'd like us to include them?\r\n- [ ] Have you written new tests for your changes? [Here's an example](https://github.com/Homebrew/homebrew/pull/49031).\r\n- [x] Have you successfully run `brew tests` with your changes locally?\r\n\r\n-----\r\n\r\nAdds a relatively simple command to update the certificates Homebrew uses for OpenSSL/LibreSSL/GnuTLS installations.\r\n\r\nCurrently we just update the certs on upgrade/reinstall of those formulae but Apple themselves sometimes push certificate changes on OS X update or doesn't update certs at all for certain OS X releases. This provides a way for people to update out-of-band, and might save Shaun & Misty some work on Linuxbrew/Tigerbrew respectively.\r\n\r\nFor the three most recent OS X releases that can still claim to be kind of to completely supported by Apple it leans on the existing post_install logic in OpenSSL/LibreSSL/GnuTLS but could just as easily be flipped around so the core logic behind that resides in this command and those formulae call this command in `postinstall`, if that's preferred.\r\n\r\nFor the older OS X releases and Linux it uses Homebrew's curl to retrieve Mozilla certs and wraps them into a nice PEM, which is similar to what Misty and Shaun already do.\r\n\r\nReviving a three year old idea. Ref: https://github.com/Homebrew/legacy-homebrew/pull/21065\r\nMore discussion over in https://github.com/Homebrew/homebrew-core/pull/971."},"comment":{"url":"https://api.github.com/repos/Homebrew/brew/issues/comments/219167628","html_url":"https://github.com/Homebrew/brew/pull/241#issuecomment-219167628","issue_url":"https://api.github.com/repos/Homebrew/brew/issues/241","id":219167628,"user":{"login":"geoff-codes","id":3162811,"avatar_url":"https://avatars.githubusercontent.com/u/3162811?v=3","gravatar_id":"","url":"https://api.github.com/users/geoff-codes","html_url":"https://github.com/geoff-codes","followers_url":"https://api.github.com/users/geoff-codes/followers","following_url":"https://api.github.com/users/geoff-codes/following{/other_user}","gists_url":"https://api.github.com/users/geoff-codes/gists{/gist_id}","starred_url":"https://api.github.com/users/geoff-codes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoff-codes/subscriptions","organizations_url":"https://api.github.com/users/geoff-codes/orgs","repos_url":"https://api.github.com/users/geoff-codes/repos","events_url":"https://api.github.com/users/geoff-codes/events{/privacy}","received_events_url":"https://api.github.com/users/geoff-codes/received_events","type":"User","site_admin":false},"created_at":"2016-05-13T21:48:45Z","updated_at":"2016-05-13T21:48:45Z","body":"Other thoughts (which maybe you're already working on, of course):\r\n- Keep a SHA256 of the latest bundle somewhere\r\n- Use it to check the bundles during `brew audit`\r\n- Possibly consider one central file, and hardlink or symlink to it, rather that copy each time?"}}