Deprecate reading all formulae through commands

We added the `--all` flag (now renamed to `--eval-all`) for various
commands for this behaviour so let's start deprecating this.

Also, introduce a `HOMEBREW_EVAL_ALL` environment variable to use the
existing, less secure, behaviour by default and avoid passing
`--eval-all` everywhere.

.github/workflows/tests.yml

@@ -82,13 +82,13 @@ jobs:
           brew update-test --commit=HEAD
 
       - name: Run brew readall on all taps
-        run: brew readall --aliases
+        run: brew readall --eval-all --aliases
 
       - name: Run brew style on homebrew-core for Linux
         run: brew style --display-cop-names homebrew/core
 
       - name: Run brew audit --skip-style on all taps
-        run: brew audit --skip-style --except=version --display-failures-only
+        run: brew audit --eval-all --skip-style --except=version --display-failures-only
 
       - name: Set up all Homebrew taps
         run: |
@@ -301,7 +301,7 @@ jobs:
                             Library/Taps/homebrew/homebrew-services
 
       - name: Run brew readall on all taps
-        run: brew readall --aliases
+        run: brew readall --eval-all --aliases
 
       - name: Install brew tests dependencies
         run: brew install subversion curl

Library/Homebrew/cask/cask.rb

@@ -24,6 +24,11 @@ class Cask
     attr_accessor :download, :allow_reassignment
 
     def self.all
+      # TODO: uncomment for 3.7.0 and ideally avoid using ARGV by moving to e.g. CLI::Parser
+      # if !ARGV.include?("--eval-all") && !Homebrew::EnvConfig.eval_all?
+      #   odeprecated "Cask::Cask#all without --all or HOMEBREW_EVAL_ALL"
+      # end
+
       Tap.flat_map(&:cask_files).map do |f|
         CaskLoader::FromTapPathLoader.new(f).load(config: nil)
       rescue CaskUnreadableError => e

Library/Homebrew/cli/args.rbi

@@ -132,6 +132,9 @@ module Homebrew
       sig { returns(T::Boolean) }
       def all?; end
 
+      sig { returns(T::Boolean) }
+      def eval_all?; end
+
       sig { returns(T::Boolean) }
       def full?; end
 

Library/Homebrew/cmd/deps.rb

@@ -54,8 +54,11 @@ def deps_args
       switch "--installed",
              description: "List dependencies for formulae that are currently installed. If <formula> is " \
                           "specified, list only its dependencies that are currently installed."
+      switch "--eval-all",
+             description: "Evaluate all available formulae and casks, whether installed or not, to list " \
+                          "their dependencies."
       switch "--all",
-             description: "List dependencies for all available formulae."
+             hidden:      true
       switch "--for-each",
              description: "Switch into the mode used by the `--all` option, but only list dependencies " \
                           "for each provided <formula>, one formula per line. This is used for " \
@@ -66,6 +69,7 @@ def deps_args
              description: "Treat all named arguments as casks."
 
       conflicts "--tree", "--graph"
+      conflicts "--installed", "--eval-all"
       conflicts "--installed", "--all"
       conflicts "--formula", "--cask"
       formula_options
@@ -77,6 +81,15 @@ def deps_args
   def deps
     args = deps_args.parse
 
+    all = args.eval_all?
+    if args.all?
+      unless all
+        odeprecated "brew deps --all",
+                    "brew deps --eval-all or HOMEBREW_EVAL_ALL"
+      end
+      all = true
+    end
+
     Formulary.enable_factory_cache!
 
     recursive = !args.direct?
@@ -118,7 +131,7 @@ def deps
 
       puts_deps_tree dependents, recursive: recursive, args: args
       return
-    elsif args.all?
+    elsif all
       puts_deps sorted_dependents(Formula.all + Cask::Cask.all), recursive: recursive, args: args
       return
     elsif !args.no_named? && args.for_each?

Library/Homebrew/cmd/desc.rb

@@ -18,8 +18,7 @@ def desc_args
     Homebrew::CLI::Parser.new do
       description <<~EOS
         Display <formula>'s name and one-line description.
-        Formula descriptions are cached; the cache is created on the
-        first search, making that search slower than subsequent ones.
+        The cache is created on the first search, making that search slower than subsequent ones.
       EOS
       switch "-s", "--search",
              description: "Search both names and descriptions for <text>. If <text> is flanked by " \
@@ -30,6 +29,9 @@ def desc_args
       switch "-d", "--description",
              description: "Search just descriptions for <text>. If <text> is flanked by slashes, " \
                           "it is interpreted as a regular expression."
+      switch "--eval-all",
+             description: "Evaluate all available formulae and casks, whether installed or not, to search their " \
+                          "descriptions. Implied if HOMEBREW_EVAL_ALL is set."
       switch "--formula", "--formulae",
              description: "Treat all named arguments as formulae."
       switch "--cask", "--casks",
@@ -44,6 +46,10 @@ def desc_args
   def desc
     args = desc_args.parse
 
+    if !args.eval_all? && !Homebrew::EnvConfig.eval_all?
+      odeprecated "brew desc", "brew desc --eval-all or HOMEBREW_EVAL_ALL"
+    end
+
     search_type = if args.search?
       :either
     elsif args.name?

Library/Homebrew/cmd/info.rb

@@ -58,9 +58,13 @@ def info_args
       switch "--installed",
              depends_on:  "--json",
              description: "Print JSON of formulae that are currently installed."
-      switch "--all",
+      switch "--eval-all",
              depends_on:  "--json",
-             description: "Print JSON of all available formulae."
+             description: "Evaluate all available formulae and casks, whether installed or not, to print their " \
+                          "JSON. Implied if HOMEBREW_EVAL_ALL is set."
+      switch "--all",
+             hidden:     true,
+             depends_on: "--json"
       switch "--variations",
              depends_on:  "--json",
              description: "Include the variations hash in each formula's JSON output."
@@ -71,6 +75,7 @@ def info_args
       switch "--cask", "--casks",
              description: "Treat all named arguments as casks."
 
+      conflicts "--installed", "--eval-all"
       conflicts "--installed", "--all"
       conflicts "--formula", "--cask"
 
@@ -103,7 +108,13 @@ def info
 
       print_analytics(args: args)
     elsif args.json
-      print_json(args: args)
+      all = args.eval_all?
+      if !all && args.all? && !Homebrew::EnvConfig.eval_all?
+        odeprecated "brew info --all", "brew info --eval-all or HOMEBREW_EVAL_ALL"
+        all = true
+      end
+
+      print_json(all, args: args)
     elsif args.github?
       raise FormulaOrCaskUnspecifiedError if args.no_named?
 
@@ -187,15 +198,15 @@ def json_version(version)
     version_hash[version]
   end
 
-  sig { params(args: CLI::Args).void }
-  def print_json(args:)
-    raise FormulaOrCaskUnspecifiedError if !(args.all? || args.installed?) && args.no_named?
+  sig { params(all: T::Boolean, args: CLI::Args).void }
+  def print_json(all, args:)
+    raise FormulaOrCaskUnspecifiedError if !(all || args.installed?) && args.no_named?
 
     json = case json_version(args.json)
     when :v1, :default
       raise UsageError, "cannot specify --cask with --json=v1!" if args.cask?
 
-      formulae = if args.all?
+      formulae = if all
         Formula.all.sort
       elsif args.installed?
         Formula.installed.sort
@@ -211,7 +222,7 @@ def print_json(args:)
         formulae.map(&:to_hash)
       end
     when :v2
-      formulae, casks = if args.all?
+      formulae, casks = if all
         [Formula.all.sort, Cask::Cask.all.sort_by(&:full_name)]
       elsif args.installed?
         [Formula.installed.sort, Cask::Caskroom.casks.sort_by(&:full_name)]

Library/Homebrew/cmd/options.rb

@@ -19,8 +19,11 @@ def options_args
              description: "Show all options on a single line separated by spaces."
       switch "--installed",
              description: "Show options for formulae that are currently installed."
+      switch "--eval-all",
+             description: "Evaluate all available formulae and casks, whether installed or not, to show their " \
+                          "options."
       switch "--all",
-             description: "Show options for all available formulae."
+             hidden: true
       flag   "--command=",
              description: "Show options for the specified <command>."
 
@@ -33,7 +36,13 @@ def options_args
   def options
     args = options_args.parse
 
+    all = args.eval_all?
     if args.all?
+      odeprecated "brew info --all", "brew info --eval-all" if !all && !Homebrew::EnvConfig.eval_all?
+      all = true
+    end
+
+    if all
       puts_options Formula.all.sort, args: args
     elsif args.installed?
       puts_options Formula.installed.sort, args: args

Library/Homebrew/cmd/readall.rb

@@ -3,6 +3,7 @@
 
 require "readall"
 require "cli/parser"
+require "env_config"
 
 module Homebrew
   extend T::Sig
@@ -22,6 +23,9 @@ def readall_args
              description: "Verify any alias symlinks in each tap."
       switch "--syntax",
              description: "Syntax-check all of Homebrew's Ruby files (if no `<tap>` is passed)."
+      switch "--eval-all",
+             description: "Evaluate all available formulae and casks, whether installed or not. " \
+                          "Implied if HOMEBREW_EVAL_ALL is set."
 
       named_args :tap
     end
@@ -39,6 +43,9 @@ def readall
 
     options = { aliases: args.aliases? }
     taps = if args.no_named?
+      if !args.eval_all? && !Homebrew::EnvConfig.eval_all?
+        odeprecated "brew readall", "brew readall --eval-all or HOMEBREW_EVAL_ALL"
+      end
       Tap
     else
       args.named.to_installed_taps

Library/Homebrew/cmd/search.rb

@@ -44,6 +44,10 @@ def search_args
       switch "--desc",
              description: "Search for formulae with a description matching <text> and casks with " \
                           "a name or description matching <text>."
+      switch "--eval-all",
+             depends_on:  "--desc",
+             description: "Evaluate all available formulae and casks, whether installed or not, to search their " \
+                          "descriptions. Implied if HOMEBREW_EVAL_ALL is set."
       switch "--pull-request",
              description: "Search for GitHub pull requests containing <text>."
       switch "--open",
@@ -75,6 +79,9 @@ def search
     string_or_regex = query_regexp(query)
 
     if args.desc?
+      if !args.eval_all? && !Homebrew::EnvConfig.eval_all?
+        odeprecated "brew search --desc", "brew search --desc --eval-all or HOMEBREW_EVAL_ALL"
+      end
       search_descriptions(string_or_regex, args)
     elsif args.pull_request?
       search_pull_requests(query, args)

Library/Homebrew/cmd/tap.rb

@@ -43,6 +43,9 @@ def tap_args
              description: "Migrate tapped formulae from symlink-based to directory-based structure."
       switch "--list-pinned",
              description: "List all pinned taps."
+      switch "--eval-all",
+             description: "Evaluate all the formulae, casks and aliases in the new tap to check validity. " \
+                          "Implied if HOMEBREW_EVAL_ALL is set."
 
       named_args :tap, max: 2
     end
@@ -65,7 +68,8 @@ def tap
         tap.install clone_target:      args.named.second,
                     force_auto_update: args.force_auto_update?,
                     custom_remote:     args.custom_remote?,
-                    quiet:             args.quiet?
+                    quiet:             args.quiet?,
+                    verify:            args.eval_all? || Homebrew::EnvConfig.eval_all?
       rescue TapRemoteMismatchError, TapNoCustomRemoteError => e
         odie e
       rescue TapAlreadyTappedError

Library/Homebrew/cmd/uses.rb

@@ -30,9 +30,11 @@ def uses_args
              description: "Resolve more than one level of dependencies."
       switch "--installed",
              description: "Only list formulae and casks that are currently installed."
+      switch "--eval-all",
+             description: "Evaluate all available formulae and casks, whether installed or not, to show " \
+                          "their dependents."
       switch "--all",
-             description: "List all formulae and casks whether installed or not.",
-             hidden:      true
+             hidden: true
       switch "--include-build",
              description: "Include all formulae that specify <formula> as `:build` type dependency."
       switch "--include-test",
@@ -88,8 +90,6 @@ def intersection_of_dependents(use_runtime_dependents, used_formulae, args:)
     show_formulae_and_casks = !args.formula? && !args.cask?
     includes, ignores = args_includes_ignores(args)
 
-    # TODO: 3.6.0: odeprecate not specifying args.all?, require args.installed?
-
     deps = []
     if use_runtime_dependents
       if show_formulae_and_casks || args.formula?
@@ -106,6 +106,18 @@ def intersection_of_dependents(use_runtime_dependents, used_formulae, args:)
 
       deps
     else
+      all = args.eval_all?
+      if args.all?
+        unless all
+          odeprecated "brew uses --all",
+                      "brew uses --eval-all or HOMEBREW_EVAL_ALL"
+        end
+        all = true
+      end
+
+      if !args.installed? && !(all || Homebrew::EnvConfig.eval_all?)
+        odeprecated "brew uses", "brew uses --eval-all or HOMEBREW_EVAL_ALL"
+      end
       if show_formulae_and_casks || args.formula?
         deps += args.installed? ? Formula.installed : Formula.all
       end

Library/Homebrew/description_cache_store.rb

@@ -34,9 +34,9 @@ def delete!(formula_name)
   #
   # @return [nil]
   def populate_if_empty!
+    return unless Homebrew::EnvConfig.eval_all?
     return unless database.empty?
 
-    # TODO: 3.6.0: consider if we want to actually read all contents of all formulae or odeprecate.
     Formula.all.each { |f| update!(f.full_name, f.desc) }
   end
 
@@ -45,6 +45,7 @@ def populate_if_empty!
   # @param report [Report] an update report generated by cmd/update.rb
   # @return [nil]
   def update_from_report!(report)
+    return unless Homebrew::EnvConfig.eval_all?
     return populate_if_empty! if database.empty?
     return if report.empty?
 
@@ -63,6 +64,7 @@ def update_from_report!(report)
   # @param formula_names [Array] the formulae to update
   # @return [nil]
   def update_from_formula_names!(formula_names)
+    return unless Homebrew::EnvConfig.eval_all?
     return populate_if_empty! if database.empty?
 
     formula_names.each do |name|
@@ -100,9 +102,9 @@ class CaskDescriptionCacheStore < DescriptionCacheStore
   #
   # @return [nil]
   def populate_if_empty!
+    return unless Homebrew::EnvConfig.eval_all?
     return unless database.empty?
 
-    # TODO: 3.6.0: consider if we want to actually read all contents of all casks or odeprecate.
     Cask::Cask.all.each { |c| update!(c.full_name, [c.name.join(", "), c.desc.presence]) }
   end
 
@@ -111,6 +113,7 @@ def populate_if_empty!
   # @param report [Report] an update report generated by cmd/update.rb
   # @return [nil]
   def update_from_report!(report)
+    return unless Homebrew::EnvConfig.eval_all?
     return populate_if_empty! if database.empty?
     return if report.empty?
 
@@ -126,6 +129,7 @@ def update_from_report!(report)
   # @param cask_tokens [Array] the casks to update
   # @return [nil]
   def update_from_cask_tokens!(cask_tokens)
+    return unless Homebrew::EnvConfig.eval_all?
     return populate_if_empty! if database.empty?
 
     cask_tokens.each do |token|