Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upgrading Homebrew and avoiding the "failed to verify attestation" error

til.simonwillison.net

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#21

Post by vbezhenar »

valbaca wrote: post #14
vbezhenar wrote: post #7

Earlier quoted context omitted.

My issues with homebrew are: 1. I hate the concept of dependency management. I want every package to ship with all dependencies inside. Just download tarball, extract and that's about it. 2. homebrew often wants to install things I already have, like python. 3. No easy way to install old packages. I don't understand why things are made harder than they should be.

> I want every package to ship with all dependencies inside. Stopping where? python? c libraries? glibc? the kernel? "all the dependencies" isn't what you think it is > 2. homebrew often wants to install things I already have, like python. oh yeah "python" like it's just A Thing You have. nothing has versions and of course every version can execute every code that's ever been written, past and future. > I don't under…

> Stopping where?

Where OS provides guarantees. If OS provides guarantee that libc will be there, do not ship libc. If OS provides guarantees that python will be there, do not ship python. If you do ship python, hide it very well, so I'd never even know about it, unless I go out of my way. And it'll never be shared by anything.

Those questions are easy and solved by every commercial software. They need to make those choices and they do make it.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#22

Post by whalesalad »

vbezhenar wrote: post #20
zdw wrote: post #12

Earlier quoted context omitted.

The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task. Shared libraries don't have this problem. Yes, they're separate packages, but having dependencies that can…

> The downside of the "bundle everything" approach (which is also used by Docker and it's ilk), is that whenever one of those dependencies needs to be fixed or upgraded (for reliability or security reasons), you have to find every instance of it on the entire system, which soon becomes an extremely difficult task. How it becomes difficult task? Just download things and replace them, when I ask to update. I have fast…

There are also ways to abstract the files on disk such that it appears every module has its own copy of “foo.so” but they’re all the same bytes on disk. Using content hashes for example. I believe this is how pnpm works.

I don’t buy the shared libraries solve problems argument either. Lots of software are pinned to a specific version anyway so just because some security update has come out for a shared lib doesn’t mean it will work with all your other software.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#23

Post by zamalek »

cglan wrote: post #2

I’ve switched over to devbox, which is a thin, easy to use wrapper around Nix on osx. Haven’t had to install brew yet. Brew was simple in theory but I always ran into so many issues like this, or just various packages polluting everything. Fingers crossed I don’t have to go back As someone who hates tinkering with this kinda stuff, I’m surprised how well it works so far

What I have learned from Nix is that polluting the global (user or system) environment is going to spell disaster at some point. Its obviously fixable in an obvious way, but why subject yourself to this nonsense in the first place. The only stuff I have in my global env is stuff I could actually use from almost anywhere, even non-code directories.

Nix isn't the only tool that solves this, there is acme and even per-compiler tools like nvm or cargo.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#24

Post by skydhash »

zdw wrote: post #4
JTyQZSnP3cQGa8B wrote: post #3

Earlier quoted context omitted.

MacPorts is a great alternative, also way older but never has been as successful as Homebrew.

Second recommendation for MacPorts It predates Homebrew by a bit and is under Apple's http://www.macosforge.org umbrella of OSS projects, so as close to 1st party support as you can get.

Third one for macports. It's more sane, at least for multi users support (I create an user for each contract work)

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#25

Post by gkoller »

zdw wrote: post #4
JTyQZSnP3cQGa8B wrote: post #3

Earlier quoted context omitted.

MacPorts is a great alternative, also way older but never has been as successful as Homebrew.

Second recommendation for MacPorts It predates Homebrew by a bit and is under Apple's http://www.macosforge.org umbrella of OSS projects, so as close to 1st party support as you can get.

MacPorts rocks. No ports breaking when upgrading MacOS as can (or could,not sure if that's still an issue) with Brew.

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#26

Post by MarkSweep »

october8140 wrote: post #5

> I frequently have rate limiting problems with my GitHub account What are people doing to get their account rate limited?

If you are in a large company that VPNs all your traffic to one point, you can get rate limited if you visit GitHub without logging in.

If you are getting the GitHub API, the rate limit is 60 request per hour, per IP. That is easy to hit. If you send an API token, it’s 5000 requests per hour.

https://docs.github.com/en/rest/using-the-rest-api/rate-limi...

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#27

Post by ashconnor »

mootoday wrote: post #8

All I can say when I see Homebrew: "I replaced Homebrew with Devbox" [1] [1] https://mootoday.com/blog/i-replaced-homebrew-with-devbox

Some folks are running nix on OSX along with nix-darwin.

https://github.com/LnL7/nix-darwin

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#29

Post by zombot »

cglan wrote: post #2

I’ve switched over to devbox, which is a thin, easy to use wrapper around Nix on osx. Haven’t had to install brew yet. Brew was simple in theory but I always ran into so many issues like this, or just various packages polluting everything. Fingers crossed I don’t have to go back As someone who hates tinkering with this kinda stuff, I’m surprised how well it works so far

In case it shouldn't work out, I never had any problems with MacPorts.

I will have a look at devbox. I always found Nix on macOS too much hassle, maybe the situation has gotten better?

Re: Upgrading Homebrew and avoiding the "failed to verify attestation" error

#30

Post by quesera »

JTyQZSnP3cQGa8B wrote: post #3
cglan wrote: post #2

I’ve switched over to devbox, which is a thin, easy to use wrapper around Nix on osx. Haven’t had to install brew yet. Brew was simple in theory but I always ran into so many issues like this, or just various packages polluting everything. Fingers crossed I don’t have to go back As someone who hates tinkering with this kinda stuff, I’m surprised how well it works so far

MacPorts is a great alternative, also way older but never has been as successful as Homebrew.

MacPorts is great!

Another excellent alternative is pkgsrc: https://pkgsrc.smartos.org/install-on-macos/

I've used pkgsrc on SmartOS/illumos and NetBSD for many years, but this is my first time using it on macOS -- about 18 months now, and all experiences positive!

Post reply on HN