shotcut 25.12.31

[samford]

Important: Do not tick a checkbox if you haven’t performed its action. Honesty is indispensable for a smooth review process.

In the following questions <cask> is the token of the cask you're submitting.

After making any changes to a cask, existing or new, verify:

• The submission is for a stable version or documented exception.
• brew audit --cask --online <cask> is error-free.
• brew style --fix <cask> reports no offenses.

Additionally, if adding a new cask:

• Named the cask according to the token reference.
• Checked the cask was not already refused (add your cask's name to the end of the search field).
• brew audit --cask --new <cask> worked successfully.
• HOMEBREW_NO_INSTALL_FROM_API=1 brew install --cask <cask> worked successfully.
• brew uninstall --cask <cask> worked successfully.

---

shotcut is autobumped but the workflow failed to update to version 25.12.31 because the file name now includes the version with dots. This updates the version and url accordingly.

[samford]

I updated this to 25.12.30 and tinkered with this some more and it seems like there isn't a winning combination of changes that will allow brew audit to pass in CI (it works fine for both archs locally on macOS 26 ARM).

• With shotcut removed from signing_audit_skiplist.json: macOS 26 (ARM) passes but macOS 15 (Intel) inexplicably errors with "Signature verification failed".
• With shotcut not removed from signing_audit_skiplist.json: macOS 15 (Intel) passes but macOS 26 (ARM) fails with "Cask is in the signing audit skiplist, but does not need to be skipped!"

Not sure how to best proceed here, as the audit for Intel works fine locally and only fails in CI (similar to a few other casks that inexplicably fail signature checks only in CI).

[khipp]

Not sure how to best proceed here, as the audit for Intel works fine locally and only fails in CI (similar to a few other casks that inexplicably fail signature checks only in CI).

Since we have seen quite a few of those issues, would it make sense to allow for a more fine-grained skiplist, similar to what we do in github_prerelease_allowlist.json? We could allow setting specific architectures, e.g., arm, intel, or all.

If it also depends on the runner's macOS version, we could be less strict about list entries in general and turn "Cask is in the signing audit skiplist, but does not need to be skipped!" into a warning.