Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

https://github.com/Homebrew/brew/issues/20755

by firexcy • 8 months ago

345 287 8 months ago

github.com

davidkellis• 8 months ago

Does this affect the linux version of homebrew? I'm hoping this has no effect.

angulardragon032• 8 months ago

No, because there is no codesigning/notarization on Linux.

kragen9• 8 months ago

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer that Apple has blessed?

I do understand that the effect is only to make Intel Macs adopt the same behavior ARM64 Macs already had, but I don't understand what that behavior is.

I see that someone named andrewmcwatters has posted a [dead] reply to my comment that doesn't answer my questions, just repeating the same jargon from the bug report that I don't know the meaning of.

andrewmcwatters• 8 months ago

Casks won’t be able to bypass Gatekeeper, so now you can’t launch .apps from brew that aren’t notarized.

So, you might as well just use the App Store.

zeckalpha• 8 months ago

Brew Casks are quite different from the App Store, but there is a CLI for the App Store if you want that: https://github.com/mas-cli/mas

shevy-java2• 8 months ago

I don't know either (right now). They closed the discussion, so they don't want people to talk about it.

Perhaps someone with more information will chime in, who isn't a homebrew maintainer.

hoistbypetard2• 8 months ago

When they closed the discussion, they explicitly welcomed people to talk about it outside their issue tracker:

Our issue trackers (other projects may differ) are used to track the work for maintainers or soliciting community contributions. They do not exist for people to debate the merits of decisions already made. We have Homebrew/discussions (and, well, the rest of the internet) for that.

They just don't want discussion about the merits of a settled decision to interfere with their work tracking when they provide a perfectly good discussion forum[1] for that.

[1](https://github.com/orgs/Homebrew/discussions)

woodruffw5• 8 months ago

Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)?

No, and no. This only affects Casks, which are prebuilt .app bundles that Homebrew has no part in building (either locally or remotely). Formulae (source builds) and bottles (builds of formulae within Homebrew) are not directly affected by any of this.

kragen9• 8 months ago

Can any random person build things from source, or do they need to be blessed by Apple?

jiehong• 8 months ago

Like you won’t be able to install clickhouse from homebrew for as long as clickhouse produce unsigned binaries.

It’s the only one affected that I currently use.

probably_wrong• 8 months ago

This is my understanding after a moderate dive into the issue.

Binaries in macOS have a signature and a set of flags. One of those flags is the "quarantine" flag that, when set, refuses to run your binary until some extra security checks have been performed (checking against a malware database, asking the user for consent, etc). Once this check is done, the flag is unset.

Usually this flag has to be set by the app you use to download the binary - in most cases it would be the web browser, but here it would be Homebrew. They used to provide a --no-quarantine flag to prevent this bit from being set, but given some changes both in macOS and in the Homebrew project it's been decided to stop offering that option. You can still unset the flag by hand, no root required, but that's on you as a user.

I believe this is a strong nudge in the direction of "for a user-friendly experience you should sign your binaries", but not a full ban.

superkuh4• 8 months ago

Or more explicitly, "for a user-friendly experience you should pay apple and ask them please to sign your binaries every year"

tom_3• 8 months ago

There'll be some way to make it work, possibly indeed that the Homebrew people get approved by Apple, because MacPorts works ok, and it seems to be downloading precompiled binaries (and if it isn't, then my Mac is actually faster than I've ever seen it run). And if MacPorts can do it, presumably Homebrew can do it too.

Building stuff yourself remains an option, even if you're unapproved. The toolchain pops the codesign step in at some point, I guess, and if you built it locally then you can run it locally. I just did cc -o on some bit of code on an Apple Silicon Mac, and the resulting binary did run.

(You can also run binaries that unapproved people built on other systems, but it's a minor pain, as you have to explicitly opt in to allowing each runnable file to run.)

kragen9• 8 months ago

I see, thanks! Is cc installed by default? I remember when my ex-wife had a Mac she had to sign up for Apple's developer program to get compilers installed.

woodruffw5• 8 months ago

MacPorts and Homebrew behave identically here: precompiled binaries are not affected, only .app (and similar) bundles.

(People find this confusing, because Homebrew does a superset of what MacPorts does: it distributes both source/binary packages and it distributes "casks", which are essentially a CLI-friendly version of the App Store and come with macOS's additional restrictions on applications. This only affects casks.)

omcnoe• 8 months ago

All it means is that applications downloaded/installed via Homebrew will no longer be able to bypass the Gatekeeper signing/notarization requirement on Intel platforms (already is the case on Arm).

If you didn't need to install a cask with this flag before you won't be impacted by the deprecation.

EasyMark3• 8 months ago

I think that homebrew will be removing those that require it as well ( or I suppose you can build from source)

seanparsons2• 8 months ago

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

JohnTHaller4• 8 months ago

The writing was on the wall from the first implementation. But we all kept getting downvoted when pointing out the road ahead.

4ndrewl• 8 months ago

Shut up and buy the sock.

JumpCrisscross2• 8 months ago

Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true

Gatekeeper can be disabled. Given Cupertino’s pivot to services and the Mac’s limited install base relative to iPhones (and high penetration among developers) I’m doubtful they’d remove that option in the foreseeable future.

ewoodrich4• 8 months ago

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk.

The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is getting ridiculously old after literally doing it a hundred times at this point. And soon enough Apple will inevitably come up with some additional hurdle like, idk, closing Settings three times in a row while reading a fingerprint during an odd numbered minute.

So in the name of "increased security" they've needlessly turned it into a binary thing where it's completely unprotected or accept my own computer that I paid for will deliberately waste my time constantly. It makes Windows 11 seem elegant in comparison where all I need to do is run Win11Debloat once on install and it gets out of my way.

[1] https://developer.apple.com/news/?id=saqachfa

bbkane• 8 months ago

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

spaceribs• 8 months ago

My family have bought macs and been apple fanboys since the "Pizzabox" 6100 PowerPC. My dad handed me down a DuoDock when I was in middle school. We bought a G4 Cube, I had an iBook and Powerbook throughout college and throughout the 2010s.

In 2017 I built my first desktop PC from the ground up and got it running Windows/Linux. I just removed Windows after the 11 upgrade required TPM, and I bought a brand new Framework laptop which I love.

This is to say that Apple used to represent a sort of freedom to escape what used to be Microsoft's walled garden. Now it's just another dead-end closed ecosystem that I'm happy to leave behind.

JCattheATM• 8 months ago

by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?)

It should be good for at least 5 years from now, if not more.

zackb2• 8 months ago

Just did this. I am so much happier. As a lifelong Apple user, and side-quest Linux user the choice is a no-brainer nowadays. Desktop Linux is honestly great now. I love(d) Apple but Tahoe was the straw that broke the camel's back for me.

i use arch btw

armchairhacker• 8 months ago

People did realize when the actual Gatekeeper change happened a year ago [1]. But your prediction still holds because frogs do realize when they're boiled in water [2].

[1] https://arstechnica.com/gadgets/2024/08/macos-15-sequoia-mak..., https://www.macrumors.com/2024/08/06/macos-sequoia-gatekeepe..., https://daringfireball.net/linked/2024/08/07/mac-os-15-sequo.... Top HN comment on Sequoia's announcement mentions it: https://news.ycombinator.com/item?id=41559761

[2] https://en.wikipedia.org/wiki/Boiling_frog#Experiments_and_a...

seanparsons2• 8 months ago

The point is that by the time Gatekeeper closes tight enough that everything must run through Apple and it can't be disabled, most people wont notice and will be stuck with it.

marcodiego3• 8 months ago

Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run.

If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.

cweagans3• 8 months ago

I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.

zackb2• 8 months ago

Asahi Linux[1] is unbelievably great on Apple Silicon. It's honestly the best Linux install experience I've ever had.

1. https://asahilinux.org/

pjmlp• 8 months ago

Neither does any other hardware vendor, even the likes of Dell, Lenovo and Asus clearly state on their online shops that their laptops work best with Windows, even when something like Ubuntu or Red-Hat is an option.

Also they hardly ship any updates.

Aurornis5• 8 months ago

Apple does not support running other OS's on their hardware.

The bootloader was intentionally left open to other OSes. You should look into Asahi Linux.

jdxcode• 8 months ago

I hate that analogy—frogs jump out.

GaryBluto• 8 months ago

I thought the problem with the analogy was that they died instantly?

Aurornis5• 8 months ago

Gatekeeper isn’t changing. Homebrew’s policies are changing.

It also only applies to casks. If you don’t use homebrew casks, nothing is changing for you.

You can also disable Gatekeeper entirely. It’s very easy.

I don’t see what you think you’re predicting, unless you’re trying to imply that that Gatekeeper is a conspiratorial plot to turn your Mac into an iPhone. I predict we’re going to be seeing those conspiracy theories for decades while it never comes true. Apple doesn’t want to destroy the market for their $5000 laptops so they can sell us a $1000 iPad as our only computing device or send customers to competitors. This is like a replay of the sky is falling drama when secure boot was announced

superkuh4• 8 months ago

It may be Apple policy to prevent users from doing what they want because "security" is the most important thing for a their bank/shopping terminals. But I thought the whole point of using homebrew was to empower the user to use Apple devices like a normal computer without the hassle of having to do it manually? The developer has made it clear this is not the use case and that it helped with it was unintentional and undesired. The actual use case for homebrew remains unclear given this new information.

nemothekid2• 8 months ago

As I understand it `--no-quarantine`, as it is currently implemented, is a noop on ARM Macs. So if Homebrew has two options:

1. Play cat and mouse with Apple to ensure `--no-quarantine` works

2. Deprecate and remove the feature.

superkuh4• 8 months ago

Well, 2. is what the people are asking for but aren't getting. They want deprecation and a ENV flag to enable. It'd be enough. But even that isn't being allowed which is weird for a power-user program. I can't help but think, "Don't obey in advance."

saagarjha7• 8 months ago

No, it definitely has an effect on Apple silicon. Without this you will be blocked from running ad-hoc signed code.

supportengineer• 8 months ago

It seems this mostly affects Intel systems.

JohnTHaller4• 8 months ago

Only true because this only works on Intel code. You can't use the typical method to bypass Gatekeeper because Apple removed it for ARM64 code.

saagarjha7• 8 months ago

No, the mechanism is the same.

foxandmouse• 8 months ago

Yeah, I’ve been noticing an alarming number of casks marked to be depreciated… at the same time gatekeeper has gotten so restrictive it won’t let me (easily) open a video files that I downloaded from the internet

JohnTHaller4• 8 months ago

Yeah, I noticed the same on my Macbook. I mainly use it for theater stuff (Qlab) and remoting into my main Windows desktop environment. I just stopped doing some of the workflows on Mac and do them on Windows because I didn't feel like trying to figure out why macOS wouldn't let GIMP open an image I downloaded from the internet. So dumb.

queenkjuul7• 8 months ago

Most ridiculous one for me so far:

- downloaded json file from my own GitHub account

- double click to open in VSCode, Apple says no

- try the usual tricks (holding alt and right clicking, i guess), no

- drag and drop file into Code, no

- right click>get info, lo and behold: the entire file contents displayed in the Get Info preview pane for me to copy

I'm actually getting a Windows laptop to do some testing on and i might just abandon Mac for the most part after that. Eating up five minutes of my day to figure out how to edit a file i created myself is just too much sometimes

tacker20007• 8 months ago

is there no way to disable this on mac silicon?

Im still on intel, and its ok here, but once I switch, will there be constant headaches and fumbling around because of this?

JohnTHaller4• 8 months ago

For a quick background, Apple doesn't allow the typical quarantine bypass of Gatekeeper for ARM64 binaries. It must be digitally signed to run. And Intel based Macs are a dead end with macOS Tahoe being the last OS released for them. So, brew is disabling the --no-quarantine switch in their next major release or so.

From the post: "What alternatives to the feature have been considered?

None. Macs with Apple silicon are the platform that will be supported in the future, and Apple is making it harder to bypass Gatekeeper as is."

Aaron22226• 8 months ago

While it is true that macOS requires binaries to have a digital signature, that can just be an ad-hoc signature. Other than that, not much has changed. Gatekeeper (and the ability to bypass it for specific apps/binaries) works much the same for unsigned Intel binaries as for ad-hoc signed Apple Silicon binaries.

tacker20007• 8 months ago

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions.

In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context.

I've been meaning to jump to macports anyway, maybe ill do it now...

anamexis• 8 months ago

What is the pro vs consumer distinction here? What consumers use homebrew?

tacker20007• 8 months ago

im talking about developers for example, that may need specific/old versions of php or node or whatever, which then get deprecated and uninstallable via brew as soon as they officially reach EOL. Or once installed, get forcefully and inadvertently updated by brew.

On the other side is some consumer who uses brew to install youtube downloader and doesnt care about versions/upgrades, etc...

ryandrake3• 8 months ago

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently).

Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Homebrew following their example is very disappointing.

EDIT: From the linked issue:

    "Intel support is coming to an end from both Apple and Homebrew."

Deeply, deeply disappointing. I know Open Source doesn't owe us anything, but this seems like a terrible turn for what was once great software.

cweagans3• 8 months ago

I'd like to see a third option

Nix, perhaps?

asdff• 8 months ago

Honestly conda does a lot of heavy lifting for me. I know people have strong feelings about it on here but it works great for my purposes.

dirkt• 8 months ago

I actually migrated from Homebrew to Macports after ending up in dependency hell in Homebrew with Postgresql + Postgis, and not being able to fix this properly even with my own brew recipes.

So for now that works a lot better in Macports. The portfile stuff needed some digging to understand, but that's doable.

Not sure what made you move from Macports to Homebrew. (Should I worry?)

nake89• 8 months ago

"Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by"

Indeed! I have a VERY usable Macbook Pro from 2015. Even with the newest version supported macOS version (11) Big Sur (which is still quite modern) it doesn't have any binaries for apps, which means it has to compile every single app and dependency.

I managed to update to macOS 14 (with the help of OpenCore Legacy Patcher).

But this just buys me one year to use Homebrew. Next year they will retire macOS 14.

And my machine is still very usable, but it will become junk from a developer perspective unless I have homebrew (or something similar).

It annoys me because I think this problem is fixable. Either community repos or more donations to homebrew to compile apps for older macs.

yakkers• 8 months ago

Nix is sort of that third option, though I really wish there was a well-documented way to use it on macOS as purely a binary/source package manager. A lot of stuff I read online goes into setting up nix-darwin to manage desktop settings and etc. and I just don't need or want that.

That being said, if you haven't used MacPorts in years, I'd say it's worth the jump. I recall moving from MacPorts in the first place because Homebrew was faster and allowed for customising packages.

When I switched back to MacPorts again, it was because Homebrew had become slow and no longer allowed package customisation. Now, MacPorts is much faster and has the variants system for package customisation.

inopinatus• 8 months ago

So-called “homebrew” has only ever grudgingly provided the barest minimum of hooks to locally build your own variants of their packages, and compares most unfavourably to, say, maintaining your own easily-rebased fork of a BSD-style ports tree. Don’t even get me started on its janky dependency resolution, versioning, “services”, and lifecycle.

The hostility and self-righteousness from the maintainers in the thread linked above just adds to the general shittiness of using it at all, and yet somehow it seems to be the lowest common denominator choice for far too many teams I’ve worked with, I suppose by sheer inertia.

wpm4• 8 months ago

I started on Macports 20 years ago, switched to homebrew because it was the new thing, and this year switched back to Macports on a brand new M4 mini, after having this gnawing feeling that I should have never switched after installing Macports on a PowerBook G4 running Tiger and building something relatively modern from source without any problems.

wvenable• 8 months ago

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions.

No different than Apple themselves!

vr46• 8 months ago

I know, is there any point in calling it Homebrew anymore when it's like an extension of the App Store?

jen20• 8 months ago

is not really useful in a pro context.

Huh, I guess I didn't use it in a "pro" context for 14 years then? Must have imagined that.

shevy-java2• 8 months ago

"Locking this thread. Not interested in arguing the merits of this. It's already been communicated to third parties."

Well!

Note: I think one problem of homebrew is called ... Apple. That is, they depend on whatever Apple decides.

Granted, this is similar to Microsoft; and to some extent to Linux, though people can make more modifications on Linux normally.

I am a Linux users so this does not affect me, and I also wrote my own "package" manager (basically just some ruby scripts to compile things from source), but at the same time I also think that at the end of the day, the user should decide what he or she wants. This is also why my scripts support systemd - I don't use/need systemd myself, but my tools should be agnostic, so I don't project my own opinion onto them.

There is of course a limitation, which is available time - often I just lack time to support xyz. But I keep that spirit alive - software should serve the human, not the other way around. (I have no substantial opinion on the feature itself here, that is to me it seems ok to remove it; the larger question is who dictates something onto users and what workarounds exist. Do workarounds exist? From reading the issue tracker, it seems the homebrew maintainers say that there are no workarounds, and thus it should be removed. If that is true then they have a point, but people also downvoted that, so perhaps there are workarounds - in which case these should be supported. I really don't know myself - to me apple is more like a glorified Windows, so basically the same. All software should be liberated eventually.)

theoldgreybeard3• 8 months ago

This has turned into a such a pain point for me I'm probably just going to ditch MacOS on my next hardware refresh and insist on a Linux-based workstation. I already use Linux for everything else, changing for $DAY_JOB is trivial.

DavideNL4• 8 months ago

Meanwhile, just automatically remove the quarantine attribute: https://news.ycombinator.com/item?id=45913209

theoldgreybeard3• 8 months ago

If I’m gonna bother doing something like that I’m just gonna use Linux and just not have to deal with it at all.

mzajc• 8 months ago

It seems the maintainers are very eager to lock issues and threads on GitHub that receive any pushback to this decision. Where is this coming from? I thought Homebrew was pro-user software, which requiring Apple's approval to run software on my computer is ostensibly not.

tacker20007• 8 months ago

if you read any old issues on the homebrew github you can see how these maintainers are always very aggressive and anti-discussion, especially the main guy.

none_to_remain• 8 months ago

The user's name is Tim Cook and it's very rude to use his computer in ways he wouldn't like

0xbadcafebee3• 8 months ago

I thought Homebrew was pro-user

As a Homebrew user: Nope.

mikemcquaid6• 8 months ago

With how Homebrew manages issues: debates about this belong in Homebrew/discussions, not on the issue tracker. That's why they get locked.

devkit12• 8 months ago

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too, but I fully expect to learn very quickly if there are a bunch of taps in use by people that distribute unsigned binary installers of software for macOS. :-)

saghm2• 8 months ago

The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too

FWIW I don't think brew has been compiling on installation even open source things by default for a while now[1]:

Homebrew provides pre-built binary packages for many formulae. These are referred to as bottles and are available at https://github.com/Homebrew/homebrew-core/packages.

The link shows close to 300 pages of precompiled packages available, and that section ends with the sentence "We aim to bottle everything".

I don't think this necessarily changes anything you've stated with regards to the flag being removed as described in the Github issue linked by OP, but I think it's still worth noting because this is markedly different than how homebrew distributed things in the past, so others might not be aware of this change either.

[1]: I assume the heading title for this docs section predates this change, but the docs section I'm referencing is https://docs.brew.sh/FAQ#why-do-you-compile-everything

frizlab• 8 months ago

FWIW I don't think brew has been compiling on installation even open source things by default for a while now

For built in formulas, no. For custom ones very much more so. I know I have a bunch I’ll never have bottles for and would thus always be compiled if used.

dylan604• 8 months ago

You can tell this in how fast things "pour". There's no way things are compiling from source that fast.

pxc7• 8 months ago

Most people I know are not installing too many casks

Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software.

I use Homebrew exclusively tucked away in isolated prefixes, only to install casks, and without ever putting any binaries it installs along the way on my PATH. I don't remember which programs it is, exactly, but I do use a few that are unsigned.

It also doesn't seem to me that the signing process is as vital in determining actual risk as the curation and moderation processes involved in maintaining "third-party" software distributions like Homebrew or Debian or whatever.

`--no-quarantine` in particular is one of the conveniences that makes Homebrew casks useful. If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell.

lilyball• 8 months ago

I haven't used Homebrew in a long time, but if I ever did it would be in the way that you describe (so far I've always found reasonable alternatives for the software I want). What I'm wondering is if this is entirely to support unsigned casks, why does Homebrew not simply resign the software itself at install time with an adhoc signature as though it had just built it?

zbentley2• 8 months ago

If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell.

Really? That's a whole lot of UI actions/clicks (and a variable number per .app) versus ... I think two always-the-same UI actions at most. Not like, a huge hassle either way, but I have trouble seeing how Homebrew's not still the winner here even without quarantine bypassing.

alwillis6• 8 months ago

Most people I know are not installing too many casks

I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas.

As of today, I have 44 casks.

[1] https://docs.brew.sh/Brew-Bundle-and-Brewfile

SOLAR_FIELDS6• 8 months ago

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this:

1password # breaks in nix, must go in /Applications folder
softwareB # not available in nixpkgs
softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for that
softwareD # ostensibly available in nixpkgs, but the package is completely broken (more general case of 1password)

Why not wrap the binaries yourself in flake.nix you say? Well, sure, would love to, if it wasn't such a pain in the ass to do so for each one and keep them up to date.

ljm• 8 months ago

Spack is a really unfortunate name for a project given that it's a slur derived from 'spastic' in the UK.

guelo• 8 months ago

casks are mostly for GUI or other apps that need special installation like setting up background services. I've seen it used for IT laptop provisioning to automate the installation of things like Chrome, Slack, Visual Studio, from the command line.

alwillis6• 8 months ago

Casks save so much time compared to the normal way of installing Mac apps regardless of any background services.

shantara2• 8 months ago

Two popular apps mentioned in the earlier discussion in Homebrew repo are Librewolf and Freetube.

https://github.com/orgs/Homebrew/discussions/6334

theoldgreybeard3• 8 months ago

I actually tried to install Librewolf today and it wouldn’t go because of gatekeeper. Ended up on Waterfox instead.

Would’ve preferred Librewolf because that’s what I run on my other desktop running Linux but what can you do…

bloppe2• 8 months ago

This is a silly distinction. You can always include pre-built object files in your "source code" formula, then the build step is just linking it into an executable locally. That would bypass the quarantine attribute and effectively retain the ability to distribute pre-built binaries without gatekeeper getting involved.

Seems like only a matter of time before someone at Apple realizes this and takes the necessary measures to protect you from yourself.

CGamesPlay2• 8 months ago

The linking step isn't even required. You can download any existing binary and codesign it yourself with your local developer certificate. You can even overwrite the existing signature.

I assume brew could even automate this, but are choosing not to for whatever reason.

dktalks• 8 months ago

Not exactly, I have automated stuff which uses python and does rar and unrar and it's installed through brew, it is not a cask, but every time I do brew update, my code will fail to run because it was updated.

This is like buying a machine and not having the ability to do whatever you want with it.

Oh who are we kidding, that's what is happening anyways.

solarkraft• 8 months ago

I have a good number of casks. I think, anyway, since I use homebrew to install a bunch of proprietary software.

mikemcquaid6• 8 months ago

Homebrew Project Leader here.

Yes, this only affects casks, not formulae, whether formulae are built from source or use Homebrew's bottles (binary packages) or bottles from taps.

noname1202• 8 months ago

As an open-source developer, is there a way to have my apps pass Gatekeeper without paying the $100/year Apple ransom and notarizing them? I think it’s the crux of the problem.

As I’m writing these lines, Homebrew has 7656 casks in the official cask tap[1]. I’m not sure exactly how many of those are unsigned but if we assume 4000 then signing them all would be an additional $400,000/year extorted by Apple from the open-source community.

Defining HOMEBREW_CASK_OPTS=--no-quarantine in my shell configuration was a good way to avoid this issue without having to manually run dozens of xattr -d every time I run brew upgrade.

Now my only option left is to pull the trigger and make my system globally less secure: sudo spctl --master-disable

Unfortunately, disabling Gatekeeper doesn’t just allow unsigned apps to run: it also completely disable all verifications for signed apps: notarization checks, revocation checks, trust evaluation checks.

[1] curl https://formulae.brew.sh/api/cask.json | jq 'length'

omnimus• 8 months ago

Typical hn comment where major feature of a software is broken because of “reasons”. But it is fine because “I and most people don't use it”.

Hey if you are not using casks you are missing out. It's by far best way to install gui apps on a mac.

Once this doesn't work its serious problem for brew because there are package managers like nix that are arguably better for developers. Something like this could start slow death of brew just like macports did before.

setopt2• 8 months ago

Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway.

I install any GUI program I can via Homebrew, there’s at least 30 casks installed currently. Don’t know how many were signed though.

skygazer• 8 months ago

Hmm. I use arm64 macports instead of homebrew, and as far as I know, I download prebuilt binaries from macports without issue even on Tahoe -- are they signing them with an approved account? Or did they force me to build everything from scratch, like the old days, and I haven't noticed?

woodruffw5• 8 months ago

This doesn't affect most prebuilt binaries. It specifically affects what Homebrew calls "casks," which are redistributions of .app bundles (which come with additional restrictions via Gatekeeper, unlike a "simple" binary).

buildfocus• 8 months ago

The contrast between the steadily shrinking freedoms in Apple-land and the open computing approach underlying all today's the Valve announcements is fascinating.

hoherd• 8 months ago

I switched from Linux to macOS with osx 10.2.8 because it was a much better unix desktop experience. Lately, more and more I've been feeling a lot like linux is a better desktop experience.

Yeah yeah, I'm sure there's a whole line of people who'd like to mock this entire decision, but I assure you that back then, a lot of us would rather use our desktop OS than fix our desktop OSes broken 802.11b, audio, graphics, etc.. And back then, osx shipped x11, and you could `ssh -Y` and `xnest` and all that fun stuff. Plus linux (and other unixes) never left my side for headless work.

Top this off with all the Android lockdown, and I feel like linux and FLOSS has maybe never been as important as it is now.

bluescrn• 8 months ago

Yet Valve have still managed to maintain a dominant 'App Store' without having to rely on locked-down platforms.

0xbadcafebee3• 8 months ago

Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads.

Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent major version change).

For anyone looking to make an alternative to Homebrew: check out asdf's plugin system! It is insanely easy for anyone to make an asdf plugin, install it, use it. It's just a directory of plaintext files/scripts somewhere on the web. I made a couple plugins for unpackaged apps within like 30 minutes of learning how plugins worked. Very "unix philosophy" (in a good way)

(aside: I'm not a "Mac person" (forced to use one by work), so I know this is an unpopular opinion, but Macs feel worse to use than either Windows or Linux. At least Windows has WSL2 if you like command-lines (or PowerShell if you're into that). OTOH Macs ship with insanely outdated incompatible tools, and the 3rd-party options are annoying as hell. Why do technical people keep using Macs?)

Onavo3• 8 months ago

Try mise

https://mise.jdx.dev/dev-tools/comparison-to-asdf.html

queenkjuul7• 8 months ago

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions are frustrating, and i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

All 3 systems have things about them that annoy me, but I'm with you that Mac is my least favorite. And it kinda sucks because the global text shortcuts (command-arrow, command-delete etc) are really handy and hard to replicate on other systems, and at least traditionally it's been a very pretty and well integrated desktop, the system itself just drives me up a wall.

alwillis6• 8 months ago

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

It's a licensing issue; Apple has never shipped GPLv3 software. This has been discussed dozens of times on HN.

Of course you can use Homebrew to install a GNU toolchain to your heart's content.

Aaron22226• 8 months ago

i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

That's not on Apple. Docker needs the Linux kernel (for Linux containers), so it's no different to needing something like Docker Desktop to use Docker on Windows. Yeah, Docker changed the license on Docker Desktop, but there's plenty of alternatives (Podman Desktop, Rancher Desktop, Colima, Apple's own container tool, or just running a Linux VM in Lima).

EasyMark3• 8 months ago

Windows makes the irritations of mac seem as tiny in comparison. Especially with them starting to move more and more to push AI into monitoring and screen capturing and keylogging literally everything you do or will ever do in the operating system. A great big No Thanks to that.

jimrandomh• 8 months ago

I think of homebrew as a curation service; it lets me name a piece of software and install it without having to any special diligence on it. In that use case, I _want_ them to enforce code-signing requirements; that reduces the risk that some software-supply-chain compromise will spread to my computer.

I do want the ability to install unsigned software, either because I wrote/compiled it myself locally and can't be arsed with signing, or because I'm getting it from a non-public source that doesn't want to share a copy with Apple, or because it's from a developer I trust who can't be arsed. But I never want to get unsigned software _from a curation service_.

bargainbin• 8 months ago

Windows and Mac competing to see who can push all their users, and upping the ante every week this year it seems.

nixpulvis5• 8 months ago

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature.

https://github.com/alacritty/alacritty/issues/8749

Does anyone know if self-signed binaries will work?

valicord• 8 months ago

if it's an open source project, why is it using a cask anyway? it should be a formula that builds from source directly

nixpulvis5• 8 months ago

I don't know much about macOS these days, but I was under the impression that Casks were for applications, and normal formula were for things installed in your PATH as standalone binaries. The .app needs a few extra things bundled up.

EDIT:

I looked it up, the issue is that homebrew explicitly doesn't want .app formulas: https://docs.brew.sh/Acceptable-Formulae#stuff-that-builds-a...

IDK what they expect. Every open source application developer needs to pay $99/yr now?

I mean you can always get the DMG from the releases on GitHub, so I guess we can just point people there and abandon homebrew. https://github.com/alacritty/alacritty/releases

DavideNL4• 8 months ago

See here for a workaround : https://news.ycombinator.com/item?id=45913209

swiftcoder• 8 months ago

It seems like all they have to do is add a post install script that clears the quarantine attribute?

nixpulvis5• 8 months ago

There's a third party tap now: https://github.com/m99coder/homebrew-tap

Time will tell if it's kept up to date.

__mharrison__• 8 months ago

Alacrity is one of my casks. I'm not tied to it. Alternatives? I guess I could just go back to terminal.

Here's my other casks:

    cask "aerospace"
    cask "alacritty"
    cask "betterdisplay"
    cask "emacs"
    cask "espanso"
    cask "hammerspoon"
    cask "jordanbaird-ice"  # ice
    cask "gimp"
    cask "inkscape"
    cask "maccy"
    cask "mactex"
    cask "macwhisper"
    cask "qmk-toolbox"
    cask "zoom"

nixpulvis5• 8 months ago

You can either use the tap which is posted in another one of my replies, or install it from the releases and remove the quarantine flag yourself as describes in both the issue I linked and my blog post from 4 years ago. Or you can build it yourself with `make app`.

anttiharju• 8 months ago

ghostty with tmux has served me well

EasyMark3• 8 months ago

iterm2 or kitty are both pretty good

Onavo3• 8 months ago

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count).

It's a pity the original author got lost in the crypto rabbit hole

https://tea.xyz/

There's also Sps2 which is written in Rust but it's very early stage

https://github.com/alexykn/sps2

Breaking the momentum and institutional adoption of homebrew is non-trivial but the developer community needs to band together unless we want to be slaves to Apple's whims forever. The current homebrew maintain Mike McQuaid clearly had no interest in listening to users.

eviks2• 8 months ago

Unfortunately, requires root, no Intel mac, no reuse of the large brew manifest library... The first 3 opened issues capture the core deficiencies perfectly

wl• 8 months ago

Mike McQuaid has been doing this a long time and there are more egregious examples in the past. I got off the Homebrew train when Little Snitch caught Homebrew phoning home without my consent and the response from him was, the developers have already decided to implement telemetry in an opt-out fashion and any pushback to that already made decision is "abusive" to the maintainers.

The Homebrew maintainers are not trustworthy. Don't use their software. If a fork was going to be feasible, it already would have happened.

Onavo3• 8 months ago

I think mise has a real chance of being a homebrew replacement, if the author chooses do take up the mantle.

Rockjodd• 8 months ago

https://github.com/jdx/mise

Just dropping this here for those who don't know about it. It solves most of my CLI dependencies.

westondeboer• 8 months ago

TL;DR

Homebrew is removing --no-quarantine because:

Apple is killing Intel support.

Apple Silicon won’t run unsigned apps anyway.

Homebrew will soon require all apps to pass Gatekeeper.

They don’t want to help users bypass macOS security.

This is basically a security + future-compatibility cleanup.

Aaron22226• 8 months ago

Apple Silicon won’t run unsigned apps anyway.

Technically true, but misleading. The macOS kernel won't execute an Apple Silicon binary that doesn't have a signature, but as Apple documents, an ad-hoc signature is enough to meet that requirement. That won't get you past Gatekeeper, but that's no different to how it is with unsigned Intel binaries.

Tyrubias2• 8 months ago

Can someone explain why disallowing Gatekeeper bypass via Homebrew is related to macOS disallowing unsigned ARM64 binaries to run? My understanding is that `—no-quarantine` just removes the `com.apple.quarantine` attribute from a downloaded application. If the application is unsigned then removing the attribute wouldn’t allow it to run anyways. There’s no way to disable the signature check because it’s a kernel level check. However, macOS will accept an adhoc signature. Because of this, to me it seems like Gatekeeper bypass and unsigned software are orthogonal topics. No matter if I remove the Gatekeeper signature or not, unsigned code still won’t run unless I add an adhoc signature. On the other hand, if I distribute software with an adhoc signature, macOS wouldn’t prevent someone else from running it as long as they remove the quarantine attribute. Am I missing something?

saagarjha7• 8 months ago

Not really, this is broadly accurate.

Tyrubias2• 8 months ago

Two questions:

1. Does this mean it’s a little disingenuous for the Homebrew maintainers to claim that this change has anything to do with app signing, given that they reference the impossibility of unsigned applications in the issue?

2. Does this mean that if a developer self-signs their app but doesn’t notarize it that it will meet Homebrew’s criteria of “passing Gatekeeper checks”?

wpm4• 8 months ago

The only thing signaling Gatekeeper to do the deep checks and also to block execution is the presence of that file attribute. When GK was first introduced in Tiger that’s literally all it consisted of; a warning/reminder that “hey slack jawed user, you downloaded this executable from the internet, be sure you trust it!” and once they said OK, the attribute was cleared and you’re not gonna get bothered again.

The AMFI checks happen on every execution of any executable. Xprotect is also running execution based checks on first run and randomly later on to check for signatures of known malware. Gatekeeper is the umbrella term for all of this on the Mac, but its still kicked off, to the user at least, as that prompt “hey champ you downloaded this from the internet and the developer didn’t want to upload this binary to Apple for scans, move it to your trash”.

Long story short, if you remove the quarantine bit, you can run whatever the fuck you want so long as Xprotect doesn’t detect anything in its YARA rules files.

fudged71• 8 months ago

Homebrew also started preventing you from installing any packages system-wide with pip

woodruffw5• 8 months ago

This is true, but also misleading: Homebrew did what every major "distro-level" package manager did, which was conform to PEP 668[1].

(This, as it turns out, was a great idea. A single global shared environment that pip used by default was one of the single greatest sources of user frustration in Python.)

[1] https://peps.python.org/pep-0668/

kstrauser3• 8 months ago

No, pip itself did that, and fortunately. It’s a setting you can disable if you want to be able to accidentally trash your environment.

saagarjha7• 8 months ago

I want to purposefully trash my environment

nbobko• 8 months ago

Hehe, the classic rude and mean behavior from homebrew maintainers.

I get their motivation to remove the flag. In fact, it has always been better to run xattr in postinstall, this way the binary is free from quarantine even after updates.

But the way they communicate with people is unacceptable and just unnecessary.

knowitnone32• 8 months ago

they pretended to have a discussion so they look good.

Vegenoid2• 8 months ago

Reading that discussion, I was very surprised at MikeMcQuaid’s reaction to xtqqczze’s concerns, which were calm, brief, and valid. In response, Mike was a dick.

Maybe it’s totally understandable that being a maintainer for the biggest mac package manager conditions a knee-jerk asshole response in a person.

mikemcquaid6• 8 months ago

There's a misunderstanding here what the issue tracker is for in Homebrew. In some projects, it's for free-for-all discussion. That's great if those projects want to use it that way.

In this issue's case, you have someone in leadership (p-linnane) communicating that work needs to be done, a maintainer (carlocab) communicating what needs to be done to make this change. xtqqczze's attempt to get us to move backwards on an already made decision doesn't help anyone. We have a discussions forum (and, well, the rest of the internet) for discussion of the pros and cons of decisions made. There's no point maintaining the illusion that we're soliciting feedback or discussion on the issues tracker when we are not.

As to me being a dick: I've been maintaining Homebrew for 16 years. It's used by millions of people. My full-time job has never been doing so and I've never been paid a market rate for my work on it (not that I expect or perhaps even deserve so). My primary concern with Homebrew is keeping the project actually running. This primarily requires the time, energy and work of maintainers doing so in their free time. It also requires contributors who submit pull requests.

Go read through some merged pull requests some time and you will see moderately to very positive responses from me. That's because that's the work that keeps the project alive. It has almost died several times in the past and I've kept it going. You may think it hyperbolic but drive-by negativity by non-code-contributor users is the biggest existential risk to projects like Homebrew.

haunter• 8 months ago

Funny/sad to see this post just under the

"Install your own apps, or even another operating system. Who are we to tell you how to use your computer?"

Turns out you can be both consumer friendly AND have a wildly successful app store. Who knew?!

mvdtnz• 8 months ago

I can run whatever I want on my Windows and Linux machines. I wouldn't put up with this, but I guess some people really feel they need their silly fruit computers.

platevoltage• 8 months ago

You run something that Windows doesn't like (like an Activator), Windows straight up deletes the application.

15155• 8 months ago

Try permanently disabling Windows Defender on modern Windows 11 and get back to me.

nixpulvis5• 8 months ago

Also, fuck Apple's entire notarization process.

https://github.com/alacritty/alacritty/issues/8749#issuecomm...

If you want a more level headed overview of code signing differences, you can read this post I wrote back when this issue started coming to a head the first time back in 2021: https://nixpulvis.com/ramblings/2021-02-02-signing-and-notar...

Now, unsurprisingly, more and more distributers are falling in line, and it's all mostly theater.

Where is our modern Stallman, how have we let these massive platform OS providers assert this much control over the developer ecosystem.

They collect $99/yr for the right to give away free software! Madness. And they lie about the safety of the system. How about focus on keeping the OS secure and maintaining process isolation, and let users run what they want.

skrrtww• 8 months ago

It's somewhat bizarre to me for this to impact "casks" but not "bottles". Bottles are all ad-hoc signed and presumably have the quarantine attribute removed manually since I do not see Gatekeeper warnings for bottles I install via Homebrew.

wpm4• 8 months ago

Downloaded files that are not executable or contains any executables in their archives don’t receive the quarantine bit. Non-quarantined executables don’t even require the ad-hoc signing as far as I know. It’s there to prevent lateral movement of executables: not to allow it to run on your computer, but to prevent it from running on someone else’s.

Aaron22226• 8 months ago

The loss of the --no-gatekeeper option isn't that big of a deal. It just removed the com.apple.quarantine xattr from the installed cask (which you can easily do yourself, or just allow the app from System Settings after Gatekeeper blocks it).

The more impactful change is the move to require all casks[0] (not just new ones) to pass Gatekeeper checks (so signed and notarized through the Apple Developer Program)[1][2]. There are a multitude of open-source applications which aren't signed and notarized through the Apple Developer Program (some due to the $99 per year cost, some due to needing to provide a legal identity and having that in the certificate, some who object to needing to do it at all). What this means is that you'll have to install these manually or use a 3rd-party tap (package repository) to install them.

Of course, Apple could solve this by providing a way for open-source projects to sign and notarize their apps without having to pay $99 per year and associate a legal identity. They've already got Xcode Cloud, they could allow use of that to build, sign, and notarize only from the publicly available source.

[0]: These are GUI applications (i.e. .app), where Homebrew downloads the official build of the app. CLI tools are done differently (the Homebrew project builds these from source), and nothing's changing there.

[1] https://github.com/orgs/Homebrew/discussions/6334

[2] https://github.com/orgs/Homebrew/discussions/6482

sunaookami• 8 months ago

I use Nix for my CLI needs but homebrew for GUI programs, anyone know of any good alternative? A lot of casks will be removed, like mktvoolnix-app (the GUI program, not the CLI tool). Also this Mike guy is insufferable.

DavideNL4• 8 months ago

Fyi, this might be a useful workaround, if you are aware of the “risks” :

“lightweight service for macOS that automatically clears quarantine flags on everything in the given folders”

https://github.com/Absolucy/autoremove-quarantine

whywhywhywhy2• 8 months ago

Protecting the user from things they don’t realize are apps or new apps on general is important.

But the amount of overreach in gatekeeper to try and make the failed Mac App Store profitable and milk $90 a year at the expense of apps users want to run is egregious.

torginus2• 8 months ago

I personally think $90 per year is reasonable and not 'milking' - I don't think it's large enough to suspect Apple making bank on this, but does represent a certain level of commitment from a dev and prevents users from spamming developer accounts.

The only scenario in which I think it's excessive is broke student devs, not sure if there's a scheme to waive the fee for them.

Not allowing regular folks to run unsigned apps is something I also agree with -though I would love if Apple allowed us to trust third-party root certs so that apps would be both signed and free of Apple's control.

charlie-83• 8 months ago

I find it hard to believe that charging people is the only way to stop people people from making multiple/spam accounts. It seems like it's just the easiest and most profitable. And, if it is the only option, then why does an account that has been paying Apple $90 a year for a decade still need to keep paying them: it's seems unlikely to be a spam account at that point.

salawat• 8 months ago

Not allowing regular folks to run unsigned apps is something I also agree with -though I would love if Apple allowed us to trust third-party root certs so that apps would be both signed and free of Apple's control.

Rolling up the ladder much? Most who can program nowadays in one form or another owe the learning experience to the fact we could write and run unsigned apps without nannery measures like Gatekeeper.

I flat out refuse henceforth the do anything that encourages mind share on fundamentally anti-user, gatekept platforms.

AlexandrB2• 8 months ago

There will be delicious irony when MacOS is locked down to the point that running homebrew is no longer possible.

WhyOhWhyQ• 8 months ago

Gatekeeper is just a travesty. I'm moving to Linux with the next laptop purchase.

verdverm• 8 months ago

Does this mean if I publish my own cask for pre built binaries, people will no longer be able to use it unless I do something with Homebrew's Gatekeeper?

If yes, this sounds a lot like the android side loading the Google just reversed

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

Related Stories