Is there a way to `brew trust` inside my Brewfile? That'd be nice for the handful of formulas I install from github repos via `brew bundle --global`.
This is described here (https://docs.brew.sh/Tap-Trust) if you scroll down a bit.
Show HN: Homebrew 6.0.0
11–20 of 380 posts
Re: Show HN: Homebrew 6.0.0
#12Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew? The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else). For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days. Some exceptional 0…
100% need this.
Re: Show HN: Homebrew 6.0.0
#13Personally I stopped using Homebrew after I got screwed too many times on mandatory upgrades that I couldn't pin. I use a combination of Mise and MacPorts now so I don't get any more surprise breakage and forced obsolescence. Plus Mise allows me to upgrade to any new version, whereas with Homebrew you have to wait for whenever the tap feels like upgrading (llama.cpp tap skips every 10 releases)
Re: Show HN: Homebrew 6.0.0
#14Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew? The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else). For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days. Some exceptional 0…
It's in this release, see this section:
> Cooldowns, livecheck and bumping
Re: Show HN: Homebrew 6.0.0
#15I have switched my full OS-level dev env to https://mise.jdx.dev/ from Homebrew+pipx+npm, initially as an experiment but found out that it actually works amazingly well. Many things get installed directly from GitHub releases or a corresponding package manager (uv, pnpm, go get ...), zero glue code to "repackage", zero version lag. You can install any arbitrary version of a package, even multiple ones at once, and dynamically adjust which ones are active per working folder or explicitly through environments.
Funnily Mise does not support dependencies, and I was quite surprised that it mostly doesn't matter, as either pnpm/uv handles that, or it's a static binary that just works. In the past, had the unfortunate experience of packaging a Python application for Homebrew (the ridiculous process involved importing around 50 dependencies as "resources", building every single one from source or manually checking if it's already on Homebrew, declaring build toolchains for 5 different programming languages as dependencies, waiting over an hour for CI to finish on every update, then an upstream update introduced a "build-time dependency loop" and the project suddenly became unpackable for Homebrew) so I totally get why Mise took the "easy way out" and just relies on language-specific package managers directly.
Only thing from my Brewfile that I couldn't replace was the Docker CLI (needed to interact with Colima). And I still use Homebrew for casks. I encourage others to experiment with their dev setups, there are some amazing new tools out there.
Re: Show HN: Homebrew 6.0.0
#16Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew? The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else). For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days. Some exceptional 0…
https://docs.brew.sh/Supply-Chain-Security details how we’re handling cooldowns and why we have a very different risk profile to e.g. NPM.
Also, where we package things from NPM/PyPi/RubyGems that have been subject to these attacks: we already apply cooldowns for you both when packaging and when creating PRs to update to new versions.
Re: Show HN: Homebrew 6.0.0
#17Awesome! Thank you for the update. I noticed that homebrew updated _all_ my casks when running 'brew upgrade' (even those with "auto_updates: true" in their Cask JSON API). Is this intended, new default behavior? This did not use to happen...
Yes this is intended. We skip those that seem to have already auto-updated underneath. Our code for this is not yet rock solid so please file issues for those you notice are not doing the right thing here.
Re: Show HN: Homebrew 6.0.0
#18I have switched my full OS-level dev env to https://mise.jdx.dev/ from Homebrew+pipx+npm, initially as an experiment but found out that it actually works amazingly well. Many things get installed directly from GitHub releases or a corresponding package manager (uv, pnpm, go get ...), zero glue code to "repackage", zero version lag. You can install any arbitrary version of a package, even multiple ones at once, and dy…
Don't forget that mise depends on package registries, to install itself as well as its tools.
Re: Show HN: Homebrew 6.0.0
#19Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew? The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else). For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days. Some exceptional 0…
It's in this release, see this section: > Cooldowns, livecheck and bumping
That's only for upstream packages, i.e. what the CI pulls in when building bottles. Homebrew itself is a rolling package manager, essentially only supporting the "latest" version for each package, which doesn't work well with the usual "only install packages older than X" concept.
Re: Show HN: Homebrew 6.0.0
#20Is the eventual goal to move most formula/cask behavior into declarative install steps and treat Ruby as an escape hatch?
Yes, exactly. The goal is you can install all official packages without needing custom postinstall/preflight/postflight blocks.