fwdcloudsec version "brew install granted" on macOS Tahoe 26.1 is creating ~/.dgranted (dev) config directory

[javabrett]

Issue Description

Installation of 0.38.0 from Homebrew via brew install granted, or macOS Tahoe creates the Granted config directory as ~/.dgranted instead of ~/.granted. This should only occur if I am running a development build.

Expected Behavior

When configuring Granted, I should see a ~/.granted directory containing a config file.

Actual Behavior

Instead I see ~/.dgranted is created. This should only happen for Dev builds.

Reproduction Steps

granted --version
Granted version: 0.38.0

sw_vers -productVersion
26.1

system_profiler SPSoftwareDataType

Software:

    System Software Overview:

      System Version: macOS 26.1 (25B78)
      Kernel Version: Darwin 25.1.0

ls ~/.*grant*
ls -ld ~/.*grant*
zsh: no matches found: /Users/brettrandall/.*grant*

granted settings
<omitted>

ls -ld ~/.*grant*
drwx------@ 4 brettrandall  staff  128  8 Dec 15:48 /Users/brettrandall/.dgranted

Granted Logs

No response

Granted Version

Granted version: 0.38.0

OS Version Information

macOS 26.1 Tahoe

Minimal Granted & AWS Config Configuration

N/A - pre-config

Additional Relevant Configuration

No response

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Granted repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.

[javabrett]

Note, I'm running zsh.

Probable old common-fate version of Homebrew formula: https://github.com/common-fate/homebrew-granted/blob/main/Formula/granted.rb

Currently Homebrew formula: https://github.com/Homebrew/homebrew-core/blob/main/Formula/g/granted.rb

Note code that determines whether we are a Dev version, and/or the name of the granted binary, and the name of the config dir is derived from that:

granted/internal/build/config.go

Lines 3 to 5 in b73724c

	// these configs are overridden as part of the release build process.
	var (
	ConfigFolderName = ".dgranted"

Wondering if build.Version is failing to set properly, maybe due to common-fate or something else in: https://github.com/Homebrew/homebrew-core/blob/9246f1d5255db05c8f9d132b2b0296c9081be718/Formula/g/granted.rb#L22 .

However the binary is reporting correct version.

Raised PR Homebrew/homebrew-core#257849 - looking for reviewers from here.

[javabrett]

Can anyone who is familiar with the granted Homebrew bottle build prior to the migration from common-fate comment on whether this ldflag was being set, or if not, how ConfigFolderName was being correctly set (to .granted, from the default .dgranted) for release builds? e.g.:

-X github.com/common-fate/granted/internal/build.ConfigFolderName=.granted

[chrnorm]

This is likely due to the homebrew core formula being used here https://github.com/Homebrew/homebrew-core/blob/main/Formula/g/granted.rb, which does not set the ldflags to use the .granted folder.

For the moment you could use the approach in this answer: #897 (comment)

I plan on setting up a new fwdcloudsec tap for Granted with the correct ldflags - you could also contribute the flags upstream to the homebrew core formula.

[javabrett]

Thanks @chrnorm .

you could also contribute the flags upstream to the homebrew core formula.

This has been done as Homebrew/homebrew-core#257849 . Would be good to get reviews there from the maintainers here to confirm that this is the correct approach.

Ideally someone with knowledge of the common-fate build could confirm that release builds were having:

github.com/common-fate/granted/internal/build.ConfigFolderName=.granted

... set somehow, since that seems to be the only current explanation for why previous bottled releases on Homebrew used ~/.granted as the config folder, but that has now regressed to ~//.dgranted like it's a dev build. Without that confirmation it's a bit unfortunate since I don't understand where the change came from, and whether this build setting completes what was previously running for common-fate bottle releases on Homebrew via the original tap.

[stefanb]

Please note, that ".granted/" is still hardcoded in a few places and thus not fully controlled via dflags:
https://github.com/search?q=repo%3Afwdcloudsec%2Fgranted+%22.granted%2F%22&type=code