Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

131–140 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#131

Post by alwillis »

queenkjuul wrote: post #98
cweagans wrote: post #64

Earlier quoted context omitted.

I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.

Apple Silicon cannot boot Windows ARM and Apple is dropping boot camp support alongside x86 support in the near future.

> Apple Silicon cannot boot Windows ARM

That's totally up to Microsoft… they could done a licensing deal with Apple years ago to enable Windows ARM to run natively on Apple Silicon hardware.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#132

Post by alwillis »

queenkjuul wrote: post #103
0xbadcafebee wrote: post #42

Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads. Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent m…

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions…

> Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think.

It's a licensing issue; Apple has never shipped GPLv3 software. This has been discussed dozens of times on HN.

Of course you can use Homebrew to install a GNU toolchain to your heart's content.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#133

Post by ewoodrich »

queenkjuul wrote: post #101
JohnTHaller wrote: post #15

Earlier quoted context omitted.

Yeah, I noticed the same on my Macbook. I mainly use it for theater stuff (Qlab) and remoting into my main Windows desktop environment. I just stopped doing some of the workflows on Mac and do them on Windows because I didn't feel like trying to figure out why macOS wouldn't let GIMP open an image I downloaded from the internet. So dumb.

Most ridiculous one for me so far: - downloaded json file from my own GitHub account - double click to open in VSCode, Apple says no - try the usual tricks (holding alt and right clicking, i guess), no - drag and drop file into Code, no - right click>get info, lo and behold: the entire file contents displayed in the Get Info preview pane for me to copy I'm actually getting a Windows laptop to do some testing on and i…

I ran into this exact same thing recently with CSVs downloaded from my own app. I tried a few different filetypes and was baffled how seemingly any filetype I downloaded triggered Gatekeeper regardless of the app I set to open it (including stock apps).

I eventually found on Reddit that setting the default via the Get Info dialog was the only path that worked, so now I can click a CSV and open it in VS Code without needing to send Apple my passport and fingerprints. I keep seeing mixed opinions whether it's a bug that Get Info associations work differently vs the right click context menu, or if it's a deliberately obtuse garden path like the Settings/Open Anyway routine and "working" as intended.

Either way I hate it but it would be slightly more forgivable as a bug (assuming it was then fixed).

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#134

Post by Tyrubias »

saagarjha wrote: post #121
Tyrubias wrote: post #74

Can someone explain why disallowing Gatekeeper bypass via Homebrew is related to macOS disallowing unsigned ARM64 binaries to run? My understanding is that `—no-quarantine` just removes the `com.apple.quarantine` attribute from a downloaded application. If the application is unsigned then removing the attribute wouldn’t allow it to run anyways. There’s no way to disable the signature check because it’s a kernel level…

Not really, this is broadly accurate.

Two questions:

1. Does this mean it’s a little disingenuous for the Homebrew maintainers to claim that this change has anything to do with app signing, given that they reference the impossibility of unsigned applications in the issue?

2. Does this mean that if a developer self-signs their app but doesn’t notarize it that it will meet Homebrew’s criteria of “passing Gatekeeper checks”?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#135

Post by zeckalpha »

andrewmcwatters wrote: post #10
kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

Casks won’t be able to bypass Gatekeeper, so now you can’t launch .apps from brew that aren’t notarized. So, you might as well just use the App Store.

Brew Casks are quite different from the App Store, but there is a CLI for the App Store if you want that: https://github.com/mas-cli/mas

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#136

Post by dangus »

marcodiego wrote: post #109
dangus wrote: post #107

Earlier quoted context omitted.

The point is that Apple could have easily locked down the bootloader and made it not possible at all to install something else. In designing the M1 hardware they explicitly went out of their way to make sure other operating systems could be installed and they’ve said as much. They took their smartphone SoCs and bootloader that never allowed alternate operating systems and added that feature in actively. Technically A…

> Technically Asahi Linux isn’t facing a much different situation than standard Linux distributions as they relate to x86 hardware. Very very different. > There are thousands of PC components that don’t provide any sort of Linux driver where contributors reverse engineer those drivers. Increasingly more rare. Maybe that only happens thèse d'ays on extremely specialized hardware.

It’s only rare these days because Linux spent decades clawing its way into data centers and workstations.

You can find a somewhat similar situation on Linux, with other non-Apple ARM hardware.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#137

Post by zackb »

bbkane wrote: post #33
seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

Just did this. I am so much happier. As a lifelong Apple user, and side-quest Linux user the choice is a no-brainer nowadays. Desktop Linux is honestly great now. I love(d) Apple but Tahoe was the straw that broke the camel's back for me.

i use arch btw

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#138

Post by viraptor »

SOLAR_FIELDS wrote: post #104
pxc wrote: post #59

Earlier quoted context omitted.

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile

What actually happened is that non free software may not be legal to distribute from nixpkgs caches, so you're on your own with building those. That's not really a purist approach.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#139

Post by zackb »

marcodiego wrote: post #43
seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.

Asahi Linux[1] is unbelievably great on Apple Silicon. It's honestly the best Linux install experience I've ever had.

1. https://asahilinux.org/

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#140

Post by skrrtww »

It's somewhat bizarre to me for this to impact "casks" but not "bottles". Bottles are all ad-hoc signed and presumably have the quarantine attribute removed manually since I do not see Gatekeeper warnings for bottles I install via Homebrew.
Post reply on HN