Harden ownership and permissions of cask apps

[MikeMcQuaid]

• Remove group and other write permissions from every app and use the platform's default cask group.
• Add read and execute access for all users only in system directories, preserving existing read and execute permissions elsewhere.
• Avoid following symlinks when changing groups and request sudo only if the unprivileged change fails.

Fixes #24002

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

[Copilot]

🟡 Changes recommended

The system-directory guard still classifies user-local absolute paths as system paths, stripping their write permissions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Restricts write permissions on cask apps installed in system directories.

Changes:

• Removes group and other write bits recursively.
• Adds permission-preservation and restriction tests.

File summaries

File	Description
Library/Homebrew/cask/artifact/app.rb	Tightens installed app permissions.
Library/Homebrew/test/cask/artifact/app_spec.rb	Tests permission handling.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Recursive cross-platform ownership and permission changes require final human validation.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

[ricardojoaoreis]

Hey! I have this env variable set HOMEBREW_CASK_OPTS=--appdir=~/Applications to install casks on my user's Applications directory and now every install/upgrade prompts for sudo. Installing an .app from a .dmg to that directory is allowed without elevated permissions but, since this commit, doing it with Homebrew is not possible.

[MikeMcQuaid]

@ricardojoaoreis will be fixed by #24011

[ricardojoaoreis]

Thanks @MikeMcQuaid! And thanks for the amazing work all these years!