Our audit of Homebrew

#1

Post by zdw » Tue, Jul 30, 2024, 10:39 PM UTC

Our audit of Homebrew
blog.trailofbits.com

Re: Our audit of Homebrew

#2

Post by yjftsjthsd-h » Tue, Jul 30, 2024, 11:14 PM UTC

There's a bunch of TOB-BREW-n listed - are those like CVE numbers just for this project?

Edit: Oh, it's "Trail Of Bits - homeBREW". But probably still yes.

Re: Our audit of Homebrew

#3

Post by woodruffw » Tue, Jul 30, 2024, 11:16 PM UTC

yjftsjthsd-h wrote: post #2

There's a bunch of TOB-BREW- n listed - are those like CVE numbers just for this project? Edit: Oh, it's "Trail Of Bits - homeBREW". But probably still yes.

Yep. We use the TOB-$PRODUCT-$XXXX convention for our audit findings, where $PRODUCT is the target under audit and $XXXX is a unique incrementing counter for each finding.

(As far as I know, a lot of audit firms do similar things.)

Re: Our audit of Homebrew

#4

Post by apitman » Tue, Jul 30, 2024, 11:32 PM UTC

A while back I was trying to understand why Homebrew requires pre-built executables to be installed into /home/linuxbrew. I asked about it here[0]. This requirement basically makes it impossible to use homebrew to quickly install programs on systems where you don't have root, or at least have homebrew already configured (not sure if that would solve it but I assume so).

They pointed me to an example program that would break if not run this way: Facebook's Watchman[1].

It bizarrely (to me) has hard coded paths compiled into it, which force you to run it from specific directories.

Would love to understand what's going on here and why you would ever make software work this way. I feel I'm missing a fairly obvious Chesterton's Fence.

[0]: https://github.com/orgs/Homebrew/discussions/5371

[1]: https://facebook.github.io/watchman/docs/install#prebuilt-bi...

Re: Our audit of Homebrew

#5

Post by bagels » Tue, Jul 30, 2024, 11:40 PM UTC

apitman wrote: post #4

A while back I was trying to understand why Homebrew requires pre-built executables to be installed into /home/linuxbrew. I asked about it here[0]. This requirement basically makes it impossible to use homebrew to quickly install programs on systems where you don't have root, or at least have homebrew already configured (not sure if that would solve it but I assume so). They pointed me to an example program that woul…

In the case of Watchman, I have to assume that internal use is the most supported use case, and uniformity of deployment is desirable across the fleet there, and so, configurability wasn't as big of a concern?

Re: Our audit of Homebrew

#6

Post by cqqxo4zV46cp » Tue, Jul 30, 2024, 11:45 PM UTC

bagels wrote: post #5

apitman wrote: post #4

A while back I was trying to understand why Homebrew requires pre-built executables to be installed into /home/linuxbrew. I asked about it here[0]. This requirement basically makes it impossible to use homebrew to quickly install programs on systems where you don't have root, or at least have homebrew already configured (not sure if that would solve it but I assume so). They pointed me to an example program that woul…

In the case of Watchman, I have to assume that internal use is the most supported use case, and uniformity of deployment is desirable across the fleet there, and so, configurability wasn't as big of a concern?

My short experience with Watchman (a few years ago) indicates this. It’s pretty clearly only technically open-source, without much regard at all paid to third parties actually using it.

Re: Our audit of Homebrew

#7

Post by [deleted] » Tue, Jul 30, 2024, 11:46 PM UTC

apitman wrote: post #4

A while back I was trying to understand why Homebrew requires pre-built executables to be installed into /home/linuxbrew. I asked about it here[0]. This requirement basically makes it impossible to use homebrew to quickly install programs on systems where you don't have root, or at least have homebrew already configured (not sure if that would solve it but I assume so). They pointed me to an example program that woul…

[deleted]

Re: Our audit of Homebrew

#8

Post by woodruffw » Tue, Jul 30, 2024, 11:49 PM UTC

I'm the author of this post and one of the people behind the audit; happy to answer questions about it.

If you're having trouble finding the audit itself (it's linked indirectly), I'm linking a copy here as well[1].

[1]: https://github.com/trailofbits/publications/blob/eb9344f2261...

Re: Our audit of Homebrew

#9

Post by apitman » Tue, Jul 30, 2024, 11:52 PM UTC

bagels wrote: post #5

apitman wrote: post #4

A while back I was trying to understand why Homebrew requires pre-built executables to be installed into /home/linuxbrew. I asked about it here[0]. This requirement basically makes it impossible to use homebrew to quickly install programs on systems where you don't have root, or at least have homebrew already configured (not sure if that would solve it but I assume so). They pointed me to an example program that woul…

In the case of Watchman, I have to assume that internal use is the most supported use case, and uniformity of deployment is desirable across the fleet there, and so, configurability wasn't as big of a concern?

That makes sense. The weird part to me is that Homebrew would limit their approach and eliminate an entire class of use cases to accommodate programs that work this way. There has to be more to it.

Re: Our audit of Homebrew

#10

Post by jmbwell » Tue, Jul 30, 2024, 11:58 PM UTC

With so many other package managers available, I often wish something else was the de facto package manager on macOS. Something like pkgsrc, which follows conventions much better and is thereby much easier to manage.