Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

161–170 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#161

Post by wpm »

Tyrubias wrote: post #74

Can someone explain why disallowing Gatekeeper bypass via Homebrew is related to macOS disallowing unsigned ARM64 binaries to run? My understanding is that `—no-quarantine` just removes the `com.apple.quarantine` attribute from a downloaded application. If the application is unsigned then removing the attribute wouldn’t allow it to run anyways. There’s no way to disable the signature check because it’s a kernel level…

The only thing signaling Gatekeeper to do the deep checks and also to block execution is the presence of that file attribute. When GK was first introduced in Tiger that’s literally all it consisted of; a warning/reminder that “hey slack jawed user, you downloaded this executable from the internet, be sure you trust it!” and once they said OK, the attribute was cleared and you’re not gonna get bothered again.

The AMFI checks happen on every execution of any executable. Xprotect is also running execution based checks on first run and randomly later on to check for signatures of known malware. Gatekeeper is the umbrella term for all of this on the Mac, but its still kicked off, to the user at least, as that prompt “hey champ you downloaded this from the internet and the developer didn’t want to upload this binary to Apple for scans, move it to your trash”.

Long story short, if you remove the quarantine bit, you can run whatever the fuck you want so long as Xprotect doesn’t detect anything in its YARA rules files.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#162

Post by ewoodrich »

wpm wrote: post #157
ewoodrich wrote: post #130

Earlier quoted context omitted.

It really bothers me that Apple removed any convenient shortcut to bypass Gatekeeper like the old Control-click [1] hotkey. Apple's relentless ratcheting of the difficulty/annoyance of Gatekeeper has just about pushed me over the edge to completely disable it, despite the risk. The ridiculous song and dance of "File is dangerous, delete it?"->No->Settings->Security->Open Anyway->"File is dangerous, delete it?"->No is…

Open Automator and make a droplet or service that runs `xattr -d com.apple.quarantine` on whatever file you give it. There’s a recursive option for xattr that I can’t remember but I add that one on too; I’ve unzipped stuff that had the flag and somehow ended up with hundreds of files I couldn’t open without GK prompts.

Thanks! I'll give that a try.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#163

Post by wpm »

skrrtww wrote: post #140

It's somewhat bizarre to me for this to impact "casks" but not "bottles". Bottles are all ad-hoc signed and presumably have the quarantine attribute removed manually since I do not see Gatekeeper warnings for bottles I install via Homebrew.

Downloaded files that are not executable or contains any executables in their archives don’t receive the quarantine bit. Non-quarantined executables don’t even require the ad-hoc signing as far as I know. It’s there to prevent lateral movement of executables: not to allow it to run on your computer, but to prevent it from running on someone else’s.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#164

Post by abnercoimbre »

JCattheATM wrote: post #96
bbkane wrote: post #33

Earlier quoted context omitted.

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

> by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?) It should be good for at least 5 years from now, if not more.

Finger crossed for mine as well!

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#165

Post by platevoltage »

mvdtnz wrote: post #102

I can run whatever I want on my Windows and Linux machines. I wouldn't put up with this, but I guess some people really feel they need their silly fruit computers.

You run something that Windows doesn't like (like an Activator), Windows straight up deletes the application.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#166

Post by dirkt »

ryandrake wrote: post #44
tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

I actually migrated from Homebrew to Macports after ending up in dependency hell in Homebrew with Postgresql + Postgis, and not being able to fix this properly even with my own brew recipes.

So for now that works a lot better in Macports. The portfile stuff needed some digging to understand, but that's doable.

Not sure what made you move from Macports to Homebrew. (Should I worry?)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#167

Post by nake89 »

ryandrake wrote: post #44
tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

As someone who migrated from macports to Homebrew, I'd like to see a third option (or maybe re-investigate macports again to see what's changed recently). Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by. One of the reasons to use third party software and a third party package manager is to avoid Apple's own insistence on abandoning old OSes. Home…

"Homebrew's insistence on leaving OSes behind that they deem to be "too old" is becoming a problem as the years click by"

Indeed! I have a VERY usable Macbook Pro from 2015. Even with the newest version supported macOS version (11) Big Sur (which is still quite modern) it doesn't have any binaries for apps, which means it has to compile every single app and dependency.

I managed to update to macOS 14 (with the help of OpenCore Legacy Patcher).

But this just buys me one year to use Homebrew. Next year they will retire macOS 14.

And my machine is still very usable, but it will become junk from a developer perspective unless I have homebrew (or something similar).

It annoys me because I think this problem is fixable. Either community repos or more donations to homebrew to compile apps for older macs.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#168

Post by Jnr »

zackb wrote: post #139
marcodiego wrote: post #43

Earlier quoted context omitted.

Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.

Asahi Linux[1] is unbelievably great on Apple Silicon. It's honestly the best Linux install experience I've ever had. 1. https://asahilinux.org/

Yes, but only on M1 and maybe M2 devices. Doesn't work at all on M4.

Stability is an issue (as I tested it with M1 Pro throughout the years).

Not all of the hardware features are supported. For example no external monitors through the usb-c port.

Also the project seems somewhat dead, having some core developers leave the project.

I had high hopes for Asahi but currently it doesn't seem like it will ever be fully production ready for currently relevant hardware.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#169

Post by solarkraft »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

I have a good number of casks. I think, anyway, since I use homebrew to install a bunch of proprietary software.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#170

Post by tort995 »

tom_ wrote: post #114
simonw wrote: post #106

Earlier quoted context omitted.

I personally use and enjoy Homebrew for most of my development tasks. The thing I would not use it for is to exactly simulate a specific combination of tool versions.

Yes. The package manager's job is to give you some sensible version of some useful common standardized thing(s) you want to use. There might well be some legacy/current/edge options, but overall you are putting your trust in their judgement and assuming that they'll do something at least vaguely sensible. If you want something specific than that: the package manager cannot help you here. This is no longer some random…

[dead]
Post reply on HN