Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

191–200 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#191

Post by fingerlocks »

queenkjuul wrote: post #101
JohnTHaller wrote: post #15

Earlier quoted context omitted.

Yeah, I noticed the same on my Macbook. I mainly use it for theater stuff (Qlab) and remoting into my main Windows desktop environment. I just stopped doing some of the workflows on Mac and do them on Windows because I didn't feel like trying to figure out why macOS wouldn't let GIMP open an image I downloaded from the internet. So dumb.

Most ridiculous one for me so far: - downloaded json file from my own GitHub account - double click to open in VSCode, Apple says no - try the usual tricks (holding alt and right clicking, i guess), no - drag and drop file into Code, no - right click>get info, lo and behold: the entire file contents displayed in the Get Info preview pane for me to copy I'm actually getting a Windows laptop to do some testing on and i…

Huh? JSON? Did you insert executable preamble bytes and chmod the file to execute or something? Where is this file? Can you post a link?

My work issued MacBook is incapable of running unsigned binaries enforced by the MDM kext, and I do all sorts of development all day long. Occasionally I have to resign a precompiled dylib if it was compiled on a coworkers machines, but that’s it. I have never seen anything like you’re describing.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#192

Post by echelon »

danudey wrote: post #81
seanparsons wrote: post #69

Earlier quoted context omitted.

The point is that by the time Gatekeeper closes tight enough that everything must run through Apple and it can't be disabled, most people wont notice and will be stuck with it.

Your assertion seems to imply that there will be a point of no return where users are no longer able to stop buying apple hardware to run the software they want, and that therefore people should do so now. If that's not what you're saying then your point is effectively moot, because if indeed Apple's platform control gets too egregious for some individuals then those people will switch at that point so there's no poi…

iPhone is already a dictator state.

We need an antitrust breakup of Apple. And Google.

These companies are rotten.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#193

Post by DavideNL »

Fyi, this might be a useful workaround, if you are aware of the “risks” :

“lightweight service for macOS that automatically clears quarantine flags on everything in the given folders”

https://github.com/Absolucy/autoremove-quarantine

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#194

Post by omnimus »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

Typical hn comment where major feature of a software is broken because of “reasons”. But it is fine because “I and most people don't use it”.

Hey if you are not using casks you are missing out. It's by far best way to install gui apps on a mac.

Once this doesn't work its serious problem for brew because there are package managers like nix that are arguably better for developers. Something like this could start slow death of brew just like macports did before.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#195

Post by DavideNL »

nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

See here for a workaround : https://news.ycombinator.com/item?id=45913209

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#196

Post by DavideNL »

theoldgreybeard wrote: post #19

This has turned into a such a pain point for me I'm probably just going to ditch MacOS on my next hardware refresh and insist on a Linux-based workstation. I already use Linux for everything else, changing for $DAY_JOB is trivial.

Meanwhile, just automatically remove the quarantine attribute: https://news.ycombinator.com/item?id=45913209

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#197

Post by yaris »

saagarjha wrote: post #120
watermelon0 wrote: post #63

Earlier quoted context omitted.

You can still run unsigned software, but you need to approve 2? prompts, and also allow exception for every executable by going to Privacy & Security tab in settings. IIRC there is a CLI command for achieving the same.

You can’t run unsigned software on Apple silicon. Note that when you build your software if you use Apple’s tools it will inject an ad-hoc signature into the product.

You very much _can_ run unsigned software on Apple silicon. At work my department has a bit less than 50 engineers with Macs (M1 to M4) and nobody complained that they can't build and run our product (using GCC from Homebrew, not Clang from Apple). But it involves some jumping through hoops, yes.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#198

Post by Mashimo »

JCattheATM wrote: post #96
bbkane wrote: post #33

Earlier quoted context omitted.

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

> by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?) It should be good for at least 5 years from now, if not more.

Probably not if you bought the 8GB version :D

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#199

Post by tclancy »

shantara wrote: post #180
theoldgreybeard wrote: post #118

Earlier quoted context omitted.

I actually tried to install Librewolf today and it wouldn’t go because of gatekeeper. Ended up on Waterfox instead. Would’ve preferred Librewolf because that’s what I run on my other desktop running Linux but what can you do…

You can still use Librewolf, if you manually remove the quarantine attribute after every update and reboot. It’s very annoying, but at least it’s possible for now xattr -dr com.apple.quarantine /Applications/LibreWolf.app

Oh wow, thanks for that, makes things even easier than “Find app and ctrl click”.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#200

Post by yaris »

Aaron2222 wrote: post #148
queenkjuul wrote: post #103

Earlier quoted context omitted.

Apple loves to change which tools they ship, too, it at least have for the last few years as system updates were routinely breaking our build scripts at work, mostly when Apple would replace a GNU tool with a BSD tool without warning i think. I agree though, Finder is a joke, the macOS system preferences has gotten incredibly cluttered and hard to use, the ever stricter code signing and download-opening restrictions…

> i can't even just install and run the docker CLI--docker on Mac requires Desktop and commercial use of Desktop requires a license. That's not on Apple. Docker needs the Linux kernel (for Linux containers), so it's no different to needing something like Docker Desktop to use Docker on Windows. Yeah, Docker changed the license on Docker Desktop, but there's plenty of alternatives (Podman Desktop, Rancher Desktop, Col…

(I may be wrong here but) under the hood Docker on macOS runs a small Linux VM where all containers live, exactly because containers are basically Linux namespaces on steroids so not portable 1:1 to anywhere.
Post reply on HN