Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upgrading Homebrew and avoiding the "failed to verify attestation" error

til.simonwillison.net

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#11

Post by 01HNNWZ0MV43FF »

ryandrake wrote: post #10
vbezhenar wrote: post #7

Earlier quoted context omitted.

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

Dependencies are totally out of control, in much of OSS, not just Homebrew. I probably have 5-6 leaf node packages that I actually installed with brew install, but brew list shows close to 100 little dependencies. Same with apt on my Ubuntu/Debian systems. I physically installed a handful of applications but my system has hundreds of packages installed. At least it’s not DLL Hell: the dependency management tools are…

But it's nice to reuse code

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#12

Post by zdw »

vbezhenar wrote: post #7
cglan wrote: post #2

I’ve switched over to devbox, which is a thin, easy to use wrapper around Nix on osx. Haven’t had to install brew yet. Brew was simple in theory but I always ran into so many issues like this, or just various packages polluting everything. Fingers crossed I don’t have to go back As someone who hates tinkering with this kinda stuff, I’m surprised how well it works so far

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task.

Shared libraries don't have this problem. Yes, they're separate packages, but having dependencies that can be upgraded separately simplifies upgrading that dependency.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#13

Post by cortesoft »

zdw wrote: post #12
vbezhenar wrote: post #7

Earlier quoted context omitted.

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task. Shared libraries don't have this problem. Yes, they're separate packages, but having dependencies that can…

This is assuming that just upgrading the shared library will work for everything. Too often, some things are broken by the upgrade, and since you weren't explicitly trying to update the thing that broke, you might not notice until a later date, at which point you may struggle to remember what was updated that it relies on.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#14

Post by valbaca »

vbezhenar wrote: post #7
cglan wrote: post #2

I’ve switched over to devbox, which is a thin, easy to use wrapper around Nix on osx. Haven’t had to install brew yet. Brew was simple in theory but I always ran into so many issues like this, or just various packages polluting everything. Fingers crossed I don’t have to go back As someone who hates tinkering with this kinda stuff, I’m surprised how well it works so far

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

> I want every package to ship with all dependencies inside.

Stopping where? python? c libraries? glibc? the kernel?

"all the dependencies" isn't what you think it is

> 2. homebrew often wants to install things I already have, like python.

oh yeah "python" like it's just A Thing You have. nothing has versions and of course every version can execute every code that's ever been written, past and future.

> I don't understand why things are made harder than they should be.

You're just willfully ignoring or not understanding the complexities.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#15

Post by zdw »

cortesoft wrote: post #13
zdw wrote: post #12

Earlier quoted context omitted.

The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task. Shared libraries don't have this problem. Yes, they're separate packages, but having dependencies that can…

This is assuming that just upgrading the shared library will work for everything. Too often, some things are broken by the upgrade, and since you weren't explicitly trying to update the thing that broke, you might not notice until a later date, at which point you may struggle to remember what was updated that it relies on.

I don't disagree that Hyrum's Law[1] is definitely a thing, but in practice with libraries that attempt SemVer or similar compatibility guarantees and understand that they'll be used in a shared library environment, breakage is not that common.

It also doesn't work for some ecosystems (like Go) where the practice is to prefer static linking.

1: https://www.hyrumslaw.com

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#16

Post by eric-hu »

ryandrake wrote: post #10
vbezhenar wrote: post #7

Earlier quoted context omitted.

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

Dependencies are totally out of control, in much of OSS, not just Homebrew. I probably have 5-6 leaf node packages that I actually installed with brew install, but brew list shows close to 100 little dependencies. Same with apt on my Ubuntu/Debian systems. I physically installed a handful of applications but my system has hundreds of packages installed. At least it’s not DLL Hell: the dependency management tools are…

There’s command to see your leaf dependencies:

https://docs.brew.sh/Manpage#leaves---installed-on-request--...

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#17

Post by ryandrake »

eric-hu wrote: post #16
ryandrake wrote: post #10

Earlier quoted context omitted.

Dependencies are totally out of control, in much of OSS, not just Homebrew. I probably have 5-6 leaf node packages that I actually installed with brew install, but brew list shows close to 100 little dependencies. Same with apt on my Ubuntu/Debian systems. I physically installed a handful of applications but my system has hundreds of packages installed. At least it’s not DLL Hell: the dependency management tools are…

There’s command to see your leaf dependencies: https://docs.brew.sh/Manpage#leaves---installed-on-request--...

Yep I use that a lot. I like to make sure I only have installed what I need to survive, and uninstall everything else.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#19

Post by simonw »

october8140 wrote: post #5

> I frequently have rate limiting problems with my GitHub account What are people doing to get their account rate limited?

I still haven't figured out quite what's going on there, but I wouldn't be surprised to learn that it was due to all of the scrapers I'm running: https://simonwillison.net/2020/Oct/9/git-scraping/

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#20

Post by vbezhenar »

zdw wrote: post #12
vbezhenar wrote: post #7

Earlier quoted context omitted.

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task. Shared libraries don't have this problem. Yes, they're separate packages, but having dependencies that can…

> The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task.

How it becomes difficult task? Just download things and replace them, when I ask to update. I have fast internet and big SSD, that's fine for me. 90% of software I'm using on my Mac are installed via alternative ways and they already bundle all the dependencies, so I already living with it.

Post reply on HN