Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

111–120 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#111

Post by CGamesPlay »

bloppe wrote: post #110
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

This is a silly distinction. You can always include pre-built object files in your "source code" formula, then the build step is just linking it into an executable locally. That would bypass the quarantine attribute and effectively retain the ability to distribute pre-built binaries without gatekeeper getting involved. Seems like only a matter of time before someone at Apple realizes this and takes the necessary meas…

The linking step isn't even required. You can download any existing binary and codesign it yourself with your local developer certificate. You can even overwrite the existing signature.

I assume brew could even automate this, but are choosing not to for whatever reason.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#112

Post by woodruffw »

fudged71 wrote: post #82

Homebrew also started preventing you from installing any packages system-wide with pip

This is true, but also misleading: Homebrew did what every major "distro-level" package manager did, which was conform to PEP 668[1].

(This, as it turns out, was a great idea. A single global shared environment that pip used by default was one of the single greatest sources of user frustration in Python.)

[1]: https://peps.python.org/pep-0668/

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#113

Post by dktalks »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

Not exactly, I have automated stuff which uses python and does rar and unrar and it's installed through brew, it is not a cask, but every time I do brew update, my code will fail to run because it was updated.

This is like buying a machine and not having the ability to do whatever you want with it.

Oh who are we kidding, that's what is happening anyways.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#114

Post by tom_ »

simonw wrote: post #106
knowitnone3 wrote: post #93

Earlier quoted context omitted.

so don't use brew at all? Great, what else should we not use?

I personally use and enjoy Homebrew for most of my development tasks. The thing I would not use it for is to exactly simulate a specific combination of tool versions.

Yes. The package manager's job is to give you some sensible version of some useful common standardized thing(s) you want to use. There might well be some legacy/current/edge options, but overall you are putting your trust in their judgement and assuming that they'll do something at least vaguely sensible.

If you want something specific than that: the package manager cannot help you here. This is no longer some random thing that you just use; it's one of your product's honest-to-goodness dependencies. You can't outsource this any more. You need to make your own arrangements to ensure that the specific version required is in use.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#115

Post by valicord »

nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

if it's an open source project, why is it using a cask anyway? it should be a formula that builds from source directly

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#116

Post by kstrauser »

fudged71 wrote: post #82

Homebrew also started preventing you from installing any packages system-wide with pip

No, pip itself did that, and fortunately. It’s a setting you can disable if you want to be able to accidentally trash your environment.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#117

Post by nixpulvis »

valicord wrote: post #115
nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

if it's an open source project, why is it using a cask anyway? it should be a formula that builds from source directly

I don't know much about macOS these days, but I was under the impression that Casks were for applications, and normal formula were for things installed in your PATH as standalone binaries. The .app needs a few extra things bundled up.

EDIT:

I looked it up, the issue is that homebrew explicitly doesn't want .app formulas: https://docs.brew.sh/Acceptable-Formulae#stuff-that-builds-a...

IDK what they expect. Every open source application developer needs to pay $99/yr now?

I mean you can always get the DMG from the releases on GitHub, so I guess we can just point people there and abandon homebrew. https://github.com/alacritty/alacritty/releases

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#118

Post by theoldgreybeard »

shantara wrote: post #87
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

Two popular apps mentioned in the earlier discussion in Homebrew repo are Librewolf and Freetube. https://github.com/orgs/Homebrew/discussions/6334

I actually tried to install Librewolf today and it wouldn’t go because of gatekeeper. Ended up on Waterfox instead.

Would’ve preferred Librewolf because that’s what I run on my other desktop running Linux but what can you do…

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#119

Post by inopinatus »

tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

So-called “homebrew” has only ever grudgingly provided the barest minimum of hooks to locally build your own variants of their packages, and compares most unfavourably to, say, maintaining your own easily-rebased fork of a BSD-style ports tree. Don’t even get me started on its janky dependency resolution, versioning, “services”, and lifecycle.

The hostility and self-righteousness from the maintainers in the thread linked above just adds to the general shittiness of using it at all, and yet somehow it seems to be the lowest common denominator choice for far too many teams I’ve worked with, I suppose by sheer inertia.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#120

Post by saagarjha »

watermelon0 wrote: post #63
dalenw wrote: post #49

Earlier quoted context omitted.

For Mac, yes and no. IIRC you don't need a developer's license to build and sign software for yourself. But you do need one to distribute pre-built software.

You can still run unsigned software, but you need to approve 2? prompts, and also allow exception for every executable by going to Privacy & Security tab in settings. IIRC there is a CLI command for achieving the same.

You can’t run unsigned software on Apple silicon. Note that when you build your software if you use Apple’s tools it will inject an ad-hoc signature into the product.
Post reply on HN