homebrew: address new CLI flag requirements (#1789)

modules/homebrew.nix

@@ -181,8 +181,8 @@ let
         ++ mapAttrsToList (k: v: "${k}=${escapeShellArg v}") config.extraEnv
         ++ [ "brew bundle --file='${brewfileFile}'" ]
         ++ optional (!config.upgrade) "--no-upgrade"
-        ++ optional (config.cleanup == "uninstall") "--cleanup"
-        ++ optional (config.cleanup == "zap") "--cleanup --zap"
+        ++ optional (config.cleanup == "uninstall") "--force-cleanup"
+        ++ optional (config.cleanup == "zap") "--zap --force-cleanup"
         ++ config.extraFlags
       );
     };
@@ -274,6 +274,21 @@ let
           for current behavior.
         '';
       };
+      trusted = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to trust this tap during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae/casks from non-official taps that haven't been trusted, aborting activation.
+          Set this to `true` for non-official taps you control so their formulae and casks are
+          installed during activation. Official taps are always trusted, so this has no effect only
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -287,7 +302,8 @@ let
           "tap ${sCfg.name}"
           + optionalString (sCfg ? clone_target) ", ${sCfg.clone_target}"
           + optionalString (sCfg ? force_auto_update)
-            ", force_auto_update: ${sCfg.force_auto_update}";
+            ", force_auto_update: ${sCfg.force_auto_update}"
+          + optionalString config.trusted ", trusted: true";
       };
   };
 
@@ -514,6 +530,27 @@ let
       # `version_file` is intentionally not exposed: it writes the installed version to a file
       # path relative to the `brew bundle` working directory, which is not meaningful during
       # nix-darwin system activation.
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this formula during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae from non-official taps that haven't been trusted, aborting activation. Set
+          this to `true` for a formula from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/formula`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain formula name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -521,14 +558,15 @@ let
     config =
       let
         sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" "link" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" "link" "trusted" ];
       in
       {
         brewfileLine =
           "brew ${sCfg.name}"
           + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
           + mkBrewfileLineBoolOrSymbolString "link" config sCfg
-          + mkBrewfileLineBoolOrSymbolString "restart_service" config sCfg;
+          + mkBrewfileLineBoolOrSymbolString "restart_service" config sCfg
+          + optionalString config.trusted ", trusted: true";
       };
   };
 
@@ -562,6 +600,27 @@ let
           on every {command}`brew bundle` run.
         '';
       };
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this cask during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load casks from non-official taps that haven't been trusted, silently skipping them. Set
+          this to `true` for a cask from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/cask`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain cask name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -569,12 +628,13 @@ let
     config =
       let
         sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "trusted" ];
       in
       {
         brewfileLine =
           "cask ${sCfg.name}"
-          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}";
+          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
+          + optionalString config.trusted ", trusted: true";
       };
   };
 in