Decide default trust policy for the Homebrew installer in install.sh/bootstrap.sh

[codeforester]

Goal

Record and act on an explicit decision about whether install.sh and
bootstrap.sh should verify Homebrew installer content by default, instead
of leaving unpinned curl | bash as the default path with pinning as opt-in.

Background

install_homebrew()/bootstrap_install_homebrew() (and the shared
base_first_mile_fetch_homebrew_installer /
base_first_mile_run_verified_homebrew_installer helpers in
lib/base/homebrew_install.sh) already implement a fully verified path:
fetch to a temp file, shasum -a 256 compare against an expected digest, and
only then execute. That path is used only when
BASE_HOMEBREW_INSTALLER_URL/BASE_HOMEBREW_INSTALLER_SHA256 (or the
per-entry-point BASE_INSTALL_*/BASE_BOOTSTRAP_* variants) are set. Without
them, both scripts fall back to installer="$(curl -fsSL "$installer_url")"
followed by /bin/bash -c "$installer" — executing Homebrew's mutable,
unpinned HEAD installer. This is disclosed to the user via
install_log_homebrew_mutable_policy / bootstrap_log_homebrew_mutable_policy
at runtime and mirrors Homebrew's own official install instructions, so it is
a conscious trade-off rather than an oversight — but it is still an
unauthenticated remote-code-execution surface on every first-mile install
that doesn't set the pinning variables, and it has never been the subject of
an explicit written decision.

Scope

• Decide, and document in docs/bootstrap.md (or the most relevant existing
  doc), whether Base's default posture should stay "mutable installer,
  disclosed" or move to "verified by default."
• If the decision is to keep the mutable default: add a short rationale
  (e.g., pinned Homebrew installer URLs go stale/break on every Homebrew
  release, so pinning cannot safely be Base's own hardcoded default) next to
  install_log_homebrew_mutable_policy's existing message, and close this
  issue as documentation-only.
• If the decision is to verify by default: give
  BASE_DEFAULT_HOMEBREW_INSTALLER_URL in install.sh/bootstrap.sh a
  paired default SHA-256, plus a documented process (and, ideally, a CI
  check or scheduled job) for refreshing that pin when Homebrew's installer
  changes upstream.

Acceptance Criteria

• The chosen trust policy is written down with its rationale in project
  documentation, not only inferred from code comments and runtime log
  lines.
• If the default changes to verified: install.sh and bootstrap.sh use
  a pinned URL + SHA-256 by default, the existing
  base_first_mile_run_verified_homebrew_installer path is exercised by
  default (dry-run and real), and a documented refresh process exists.
• If the default stays mutable: the existing disclosure message is kept
  and the rationale for not pinning by default is documented.

Validation

• basectl test base (or the narrowest BATS suite covering install.sh /
  bootstrap.sh / lib/base/homebrew_install.sh)
• ./install.sh --dry-run and ./bootstrap.sh --dry-run to confirm the
  logged trust-policy message matches the decision
• git diff --check for the documentation update

Non-Goals

• Does not change how Base verifies its own Git checkout, release artifacts,
  or the base-cli/base-bash-libs dependencies — this issue is scoped to
  the Homebrew first-mile bootstrap path only.
• Does not remove the existing opt-in pinning mechanism regardless of which
  default is chosen.

Project Fields

Status: Backlog · Priority: P2 · Size: S · Area: Security · Initiative: Contract Hardening

Agent Assignment

Human first