Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software • Hacker News Board

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#151

Post by 0xbadcafebee » Thu, Nov 13, 2025, 5:13 AM UTC

alwillis wrote: post #132

queenkjuul wrote: post #103

Earlier quoted context omitted.

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions…

> Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. It's a licensing issue; Apple has never shipped GPLv3 software. This has been discussed dozens of times on HN. Of course you can use Homebrew to install a GNU toolchain to you…

Well there's now an MIT-licensed Rust rewrite of GNU coretools. Maybe in a few years they'll ship that, and we won't have to faff about with crappy 3rd party solutions. (I mean, seriously, when Windows ships with better dev tools than you? That's embarrassing.)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#152

Post by Aaron2222 » Thu, Nov 13, 2025, 5:14 AM UTC

Tyrubias wrote: post #134

saagarjha wrote: post #121

Earlier quoted context omitted.

Not really, this is broadly accurate.

Two questions: 1. Does this mean it’s a little disingenuous for the Homebrew maintainers to claim that this change has anything to do with app signing, given that they reference the impossibility of unsigned applications in the issue? 2. Does this mean that if a developer self-signs their app but doesn’t notarize it that it will meet Homebrew’s criteria of “passing Gatekeeper checks”?

1. Yes. (Either that or they know something we don't about Apple's future plans.) 2. No, as Gatekeeper checks both for a valid signature from an Apple Developer Program certificate as well as notarization.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#153

Post by Aaron2222 » Thu, Nov 13, 2025, 5:15 AM UTC

westondeboer wrote: post #73

TL;DR Homebrew is removing --no-quarantine because: Apple is killing Intel support. Apple Silicon won’t run unsigned apps anyway. Homebrew will soon require all apps to pass Gatekeeper. They don’t want to help users bypass macOS security. This is basically a security + future-compatibility cleanup.

> Apple Silicon won’t run unsigned apps anyway.

Technically true, but misleading. The macOS kernel won't execute an Apple Silicon binary that doesn't have a signature, but as Apple documents, an ad-hoc signature is enough to meet that requirement. That won't get you past Gatekeeper, but that's no different to how it is with unsigned Intel binaries.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#154

Post by Aaron2222 » Thu, Nov 13, 2025, 5:31 AM UTC

The loss of the --no-gatekeeper option isn't that big of a deal. It just removed the com.apple.quarantine xattr from the installed cask (which you can easily do yourself, or just allow the app from System Settings after Gatekeeper blocks it).

The more impactful change is the move to require all casks[0] (not just new ones) to pass Gatekeeper checks (so signed and notarized through the Apple Developer Program)[1][2]. There are a multitude of open-source applications which aren't signed and notarized through the Apple Developer Program (some due to the $99 per year cost, some due to needing to provide a legal identity and having that in the certificate, some who object to needing to do it at all). What this means is that you'll have to install these manually or use a 3rd-party tap (package repository) to install them.

Of course, Apple could solve this by providing a way for open-source projects to sign and notarize their apps without having to pay $99 per year and associate a legal identity. They've already got Xcode Cloud, they could allow use of that to build, sign, and notarize only from the publicly available source.

[0]: These are GUI applications (i.e. .app), where Homebrew downloads the official build of the app. CLI tools are done differently (the Homebrew project builds these from source), and nothing's changing there.

[1]: https://github.com/orgs/Homebrew/discussions/6334

[2]: https://github.com/orgs/Homebrew/discussions/6482

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#155

Post by potamic » Thu, Nov 13, 2025, 5:33 AM UTC

simonw wrote: post #37

tacker2000 wrote: post #31

Earlier quoted context omitted.

im talking about developers for example, that may need specific/old versions of php or node or whatever, which then get deprecated and uninstallable via brew as soon as they officially reach EOL. Or once installed, get forcefully and inadvertently updated by brew. On the other side is some consumer who uses brew to install youtube downloader and doesnt care about versions/upgrades, etc...

If you are a developer who needs a specific old version of PHP or Node or whatever and you're not using Docker then I have great news for you on how you can solve your problem.

When all you have is a hammer, everything looks like a nail.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#156

Post by eviks » Thu, Nov 13, 2025, 5:35 AM UTC

Onavo wrote: post #55

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count). It's a pity the original author got lost in the crypto rabbit hole https://tea.xyz/ There's also Sps2 which is written in Rust but it's very early stage https://github.com/alexykn/sps2 Breaking the momentum and institutional adoption of homebrew is non-trivial but the…

Unfortunately, requires root, no Intel mac, no reuse of the large brew manifest library... The first 3 opened issues capture the core deficiencies perfectly

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#157

Post by wpm » Thu, Nov 13, 2025, 5:36 AM UTC

ewoodrich wrote: post #130

JumpCrisscross wrote: post #29

Earlier quoted context omitted.

> Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true Gatekeeper can be disabled. Given Cupertino’s pivot to services and the Mac’s limited install base relative to iPhones (and high penetration among developers) I’m doubtful they’d remove that option in the foreseeable future.

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk. The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is…

Open Automator and make a droplet or service that runs `xattr -d com.apple.quarantine` on whatever file you give it. There’s a recursive option for xattr that I can’t remember but I add that one on too; I’ve unzipped stuff that had the flag and somehow ended up with hundreds of files I couldn’t open without GK prompts.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#158

Post by wpm » Thu, Nov 13, 2025, 5:44 AM UTC

tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

I started on Macports 20 years ago, switched to homebrew because it was the new thing, and this year switched back to Macports on a brand new M4 mini, after having this gnawing feeling that I should have never switched after installing Macports on a PowerBook G4 running Tiger and building something relatively modern from source without any problems.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#159

Post by ewoodrich » Thu, Nov 13, 2025, 5:48 AM UTC

JumpCrisscross wrote: post #149

ewoodrich wrote: post #130

Earlier quoted context omitted.

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk. The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is…

> in the name of "increased security" they've needlessly turned it into a binary thing where it's completely unprotected Why isn't a binary condition valid? Isn't that the ethos inherent to a literal walled garden? If you're inside, trust us. If you're outside, you don't, but don't expect us to bail you out.

I didn’t say it was invalid, just that it was needless. When I bought the laptop Gatekeeper was a tolerable nuisance and I was fine with the tradeoff given the security benefits.

The removal of the hotkey (which also required changing a setting before it worked at all) didn’t actually make it harder for a regular user to access, just 5x as aggravating every time it's necessary.

If they made developers go through some long and tedious process to re-enable it I would grumble but understand, but the only solution to get back to the 2024 status quo being entirely disabling a critical security feature certainly doesn't benefit me in any way.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#160

Post by eviks » Thu, Nov 13, 2025, 5:49 AM UTC

viraptor wrote: post #138

SOLAR_FIELDS wrote: post #104

Earlier quoted context omitted.

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile What actually happened is that non free software may not be legal to distribute from nixpkgs caches, so you're on your own with building those. That's not really a purist approach.

Why can't you distribute it from the developer's website?