Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

141–150 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#141

Post by supriyo-biswas »

tacker2000 wrote: post #31
anamexis wrote: post #22

Earlier quoted context omitted.

What is the pro vs consumer distinction here? What consumers use homebrew?

im talking about developers for example, that may need specific/old versions of php or node or whatever, which then get deprecated and uninstallable via brew as soon as they officially reach EOL. Or once installed, get forcefully and inadvertently updated by brew. On the other side is some consumer who uses brew to install youtube downloader and doesnt care about versions/upgrades, etc...

brew install php@X.Y doesn’t work for you?

Although I should say that I haven’t tried to go back many major versions, I wonder if they provide 7.x for example.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#142

Post by kstrauser »

saagarjha wrote: post #122
kstrauser wrote: post #116

Earlier quoted context omitted.

No, pip itself did that, and fortunately. It’s a setting you can disable if you want to be able to accidentally trash your environment.

I want to purposefully trash my environment

Pip will let you! You just have to ask it nicely.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#143

Post by fastily »

alwillis wrote: post #91
pxc wrote: post #59

Earlier quoted context omitted.

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

> Most people I know are not installing too many casks I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas. As of today, I have 44 casks. [1]: https://docs.brew.sh/Brew-Bundle-and-Brewfile

I do something similar. I bootstrap all my new installs with brew cask https://github.com/fastily/autobots/tree/master/macOS/setup

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#144

Post by cweagans »

marcodiego wrote: post #77
cweagans wrote: post #64

Earlier quoted context omitted.

I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.

> they literally don't do anything to prevent you from running another OS. Like not documenting their hardware? Like making Asahi Linux becoming a multi-year reverse engineering project that may possibly never achieve perfect compatibility? > They make it easy to run Windows On apple silicon without virtualisation? Sorry, didn't know that.

> Like not documenting their hardware?

They aren't actively hindering that reverse engineering effort. They aren't _helping_ either, but I didn't claim that they were helping. For as long as I can remember, Apple's stance with Mac computers has been "We sell the computers to you in the way we think is best. If you want to tinker, that's on you." and I don't think that has materially changed.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#145

Post by Klonoar »

cweagans wrote: post #66
ryandrake wrote: post #44

Earlier quoted context omitted.

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

> I'd like to see a third option Nix, perhaps?

Make Fink modern. ;)

(Part /s, part not)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#146

Post by Aaron2222 »

JohnTHaller wrote: post #11

For a quick background, Apple doesn't allow the typical quarantine bypass of Gatekeeper for ARM64 binaries. It must be digitally signed to run. And Intel based Macs are a dead end with macOS Tahoe being the last OS released for them. So, brew is disabling the --no-quarantine switch in their next major release or so. From the post: "What alternatives to the feature have been considered? None. Macs with Apple silicon a…

While it is true that macOS requires binaries to have a digital signature, that can just be an ad-hoc signature. Other than that, not much has changed. Gatekeeper (and the ability to bypass it for specific apps/binaries) works much the same for unsigned Intel binaries as for ad-hoc signed Apple Silicon binaries.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#147

Post by [deleted] »

alwillis wrote: post #132
queenkjuul wrote: post #103

Earlier quoted context omitted.

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions…

> Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. It's a licensing issue; Apple has never shipped GPLv3 software. This has been discussed dozens of times on HN. Of course you can use Homebrew to install a GNU toolchain to you…

[deleted]

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#148

Post by Aaron2222 »

queenkjuul wrote: post #103
0xbadcafebee wrote: post #42

Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads. Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent m…

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions…

> i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license.

That's not on Apple. Docker needs the Linux kernel (for Linux containers), so it's no different to needing something like Docker Desktop to use Docker on Windows. Yeah, Docker changed the license on Docker Desktop, but there's plenty of alternatives (Podman Desktop, Rancher Desktop, Colima, Apple's own container tool, or just running a Linux VM in Lima).

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#149

Post by JumpCrisscross »

ewoodrich wrote: post #130
JumpCrisscross wrote: post #29

Earlier quoted context omitted.

> Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true Gatekeeper can be disabled. Given Cupertino’s pivot to services and the Mac’s limited install base relative to iPhones (and high penetration among developers) I’m doubtful they’d remove that option in the foreseeable future.

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk. The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is…

> in the name of "increased security" they've needlessly turned it into a binary thing where it's completely unprotected

Why isn't a binary condition valid? Isn't that the ethos inherent to a literal walled garden?

If you're inside, trust us. If you're outside, you don't, but don't expect us to bail you out.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#150

Post by Aaron2222 »

saagarjha wrote: post #124
JohnTHaller wrote: post #12

Earlier quoted context omitted.

Only true because this only works on Intel code. You can't use the typical method to bypass Gatekeeper because Apple removed it for ARM64 code.

No, the mechanism is the same.

To clarify, the macOS kernel requires a signature on all Apple Silicon binaries, but this can just be an ad-hoc signature. Ad-hoc signed Apple Silicon applications are treated much the same as unsigned Intel ones.
Post reply on HN