Can we get an official confirmation about the "Team ID" change?

[will-darkwolf]

Output of brew config

➜  Downloads /usr/sbin/spctl -a -vv -t install ./Homebrew-4.2.15.pkg 
./Homebrew-4.2.15.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: Mike McQuaid (6248TWFRH6)
➜  Downloads /usr/sbin/spctl -a -vv -t install ./Homebrew-4.3.15.pkg 
./Homebrew-4.3.15.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: Patrick Linnane (927JGANW46)

Output of brew doctor

➜  Downloads /usr/sbin/spctl -a -vv -t install ./Homebrew-4.2.15.pkg 
./Homebrew-4.2.15.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: Mike McQuaid (6248TWFRH6)
➜  Downloads /usr/sbin/spctl -a -vv -t install ./Homebrew-4.3.15.pkg 
./Homebrew-4.3.15.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: Patrick Linnane (927JGANW46)

Description of issue

I use a custom script to verify the Team ID for the pkg file before installing it on macOS. This has been pretty stable for a while, with them being signed by Mike McQuaid. Recently, I went to deploy it on a new device and the package is now signed by Patrick Linnane. He appears to be associated with the project on GitHub, but it would be nice if there was an "official" announcement somewhere acknowledging this change. After the XZ Incident in March, I know many people are more paranoid than they used to be. Installomator states in an issue that they were able to confirm with the Homebrew team that the new ID was legitimate, Installomator/Installomator#1726.

Can we get an official confirmation of the new Team ID posted somewhere?

Thank you

[SMillerDev]

https://infosec.exchange/@shuu/112803268733080002 which was also shared by the homebrew account is it as far as announcements go.

[p-linnane]

This should remain stable being signed by my account for at least the next few years while I'm serving on the Project Leadership Committee.