Homebrew support

[jmcvetta]

This PR adds a profile for the Homebrew package manager.

Summary by Sourcery

Add a new Homebrew profile to the configuration system and wire it into the profile registry.

New Features:

• Introduce a Homebrew profile with its own package set and description.
• Provide a profile expansion for Homebrew that composes with the core profile.
• Add a Homebrew-specific profile generator that installs required system packages and Homebrew via its official install script.

Enhancements:

• Extend the exported profile functions list to include the new Homebrew profile handler.

[sourcery-ai]

Reviewer's Guide

Adds a new Homebrew profile to the image configuration system, including package selection, profile metadata, expansion behavior, Docker build steps, and export wiring so images can be built with Homebrew preinstalled.

Class diagram for Homebrew profile integration in config system

classDiagram
    class ConfigSystem {
        +get_profile_packages(profile_name)
        +get_profile_description(profile_name)
        +get_all_profile_names()
        +profile_exists(profile_name)
        +expand_profile(profile_name)
        +get_profile_ml()
        +get_profile_homebrew()
    }

    class ProfilePackages {
        +core
        +build_tools
        +ml
        +homebrew
    }

    class ProfileDescriptions {
        +core
        +build_tools
        +ml
        +homebrew
    }

    class ProfileExpansion {
        +core
        +build_tools
        +ml
        +homebrew
    }

    ConfigSystem --> ProfilePackages : uses
    ConfigSystem --> ProfileDescriptions : uses
    ConfigSystem --> ProfileExpansion : uses

    class HomebrewProfile {
        +packages : build-essential curl file procps locales
        +description : Homebrew Package Manager
        +expanded_profiles : core homebrew
        +docker_steps()
    }

    HomebrewProfile ..> ConfigSystem : configured_through
    HomebrewProfile ..> ProfilePackages : defines_packages
    HomebrewProfile ..> ProfileDescriptions : defines_description
    HomebrewProfile ..> ProfileExpansion : defines_expansion

Loading

File-Level Changes

Change	Details	Files
Introduce a Homebrew profile with its own package set, description, and expansion behavior.	Add Homebrew-specific packages to the profile package switch for use during image build Provide a human-readable description string for the Homebrew profile Include the Homebrew profile name in the list of all available profiles Define how the Homebrew profile expands into underlying base profiles when selected	lib/config.sh
Implement the Homebrew profile build steps and expose the profile getter function for use by the rest of the system.	Add get_profile_homebrew implementation to install apt prerequisites and run the Homebrew install script as the claude user Set PATH so the installed Homebrew binaries are available and verify installation via brew --version Switch back to root after installation to maintain expected Docker build user state Export get_profile_homebrew so it can be called like other profile getters	lib/config.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[jmcvetta]

PR Review: Homebrew Support (#98)

Summary

Adds Homebrew profile to ClaudeBox. Clean implementation following existing patterns.

Strengths

• ✅ Follows ClaudeBox conventions (function-based, Bash 3.2 compatible)
• ✅ Proper integration into profile system (packages, description, expansion, exports)
• ✅ Correct user switching (claude → root)
• ✅ Silent curl flags (-fsSL), NONINTERACTIVE=1, apt-get clean
• ✅ Verification step (brew --version)
• ✅ Depends only on core profile (appropriate)
• ✅ Includes locales per Homebrew recommendations

Notes

• Unpinned install script (fetches from HEAD) is standard for Homebrew - acceptable tradeoff for always-current installer
• Homebrew itself is also unpinned, consistent with other ClaudeBox profiles (rust, python, etc.)

Recommendation

Approve - Solid work, ready to merge.

---

Files: lib/config.sh (+23, -2)

---

Review by Claude Code (claude-sonnet-4-5)

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The expand_profile case for homebrew returns core homebrew, which reintroduces the same profile name and risks confusing or recursive expansion logic; consider expanding only to core (or another concrete set of profiles) instead.
• The get_profile_homebrew snippet assumes a claude user exists in the base image; if that user is not guaranteed, consider parameterizing the username or deriving it from existing configuration to avoid build-time failures.
• The Homebrew install currently downloads and executes the latest HEAD install script directly via curl; consider pinning to a specific commit or adding a checksum/validation step to improve reproducibility and safety.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `expand_profile` case for `homebrew` returns `core homebrew`, which reintroduces the same profile name and risks confusing or recursive expansion logic; consider expanding only to `core` (or another concrete set of profiles) instead.
- The `get_profile_homebrew` snippet assumes a `claude` user exists in the base image; if that user is not guaranteed, consider parameterizing the username or deriving it from existing configuration to avoid build-time failures.
- The Homebrew install currently downloads and executes the latest `HEAD` install script directly via `curl`; consider pinning to a specific commit or adding a checksum/validation step to improve reproducibility and safety.

## Individual Comments

### Comment 1
<location> `lib/config.sh:380` </location>
<code_context>
+USER claude
+
+# Homebrew does not publish versioned releases of its install script
+RUN NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+ENV PATH="/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:${PATH}"
+RUN brew --version  # Confirm installation
</code_context>

<issue_to_address>
**🚨 issue (security):** `curl | bash` style install of an unpinned script is a security and reproducibility risk.

Executing the install script from `HEAD` at build time makes builds non-deterministic and exposes you to any repo or network compromise. Where possible, pin this to a specific commit or tagged release URL and/or verify a checksum or signature before running it, so the image is reproducible and less vulnerable to supply-chain attacks.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 issue (security): curl | bash style install of an unpinned script is a security and reproducibility risk.

Executing the install script from HEAD at build time makes builds non-deterministic and exposes you to any repo or network compromise. Where possible, pin this to a specific commit or tagged release URL and/or verify a checksum or signature before running it, so the image is reproducible and less vulnerable to supply-chain attacks.