Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

21–30 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#21

Post by woodruffw »

kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

> Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)?

No, and no. This only affects Casks, which are prebuilt .app bundles that Homebrew has no part in building (either locally or remotely). Formulae (source builds) and bottles (builds of formulae within Homebrew) are not directly affected by any of this.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#22

Post by anamexis »

tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

What is the pro vs consumer distinction here? What consumers use homebrew?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#23

Post by nemothekid »

superkuh wrote: post #5

It may be Apple policy to prevent users from doing what they want because "security" is the most important thing for a their bank/shopping terminals. But I thought the whole point of using homebrew was to empower the user to use Apple devices like a normal computer without the hassle of having to do it manually? The developer has made it clear this is not the use case and that it helped with it was unintentional and…

As I understand it `--no-quarantine`, as it is currently implemented, is a noop on ARM Macs. So if Homebrew has two options:

1. Play cat and mouse with Apple to ensure `--no-quarantine` works

2. Deprecate and remove the feature.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#24

Post by devkit1 »

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt appear to impact homebrew's ability to download, compile, and install open source software. And that is the main thing I use homebrew for. I believe that is true for most people too, but I fully expect to learn very quickly if there are a bunch of taps in use by people that distribute unsigned binary installers of software for macOS. :-)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#25

Post by superkuh »

nemothekid wrote: post #23
superkuh wrote: post #5

It may be Apple policy to prevent users from doing what they want because "security" is the most important thing for a their bank/shopping terminals. But I thought the whole point of using homebrew was to empower the user to use Apple devices like a normal computer without the hassle of having to do it manually? The developer has made it clear this is not the use case and that it helped with it was unintentional and…

As I understand it `--no-quarantine`, as it is currently implemented, is a noop on ARM Macs. So if Homebrew has two options: 1. Play cat and mouse with Apple to ensure `--no-quarantine` works 2. Deprecate and remove the feature.

Well, 2. is what the people are asking for but aren't getting. They want deprecation and a ENV flag to enable. It'd be enough. But even that isn't being allowed which is weird for a power-user program. I can't help but think, "Don't obey in advance."

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#26

Post by skygazer »

Hmm. I use arm64 macports instead of homebrew, and as far as I know, I download prebuilt binaries from macports without issue even on Tahoe -- are they signing them with an approved account? Or did they force me to build everything from scratch, like the old days, and I haven't noticed?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#27

Post by jiehong »

kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

Like you won’t be able to install clickhouse from homebrew for as long as clickhouse produce unsigned binaries.

It’s the only one affected that I currently use.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#29

Post by JumpCrisscross »

seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

> Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true

Gatekeeper can be disabled. Given Cupertino’s pivot to services and the Mac’s limited install base relative to iPhones (and high penetration among developers) I’m doubtful they’d remove that option in the foreseeable future.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#30

Post by probably_wrong »

kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

This is my understanding after a moderate dive into the issue.

Binaries in macOS have a signature and a set of flags. One of those flags is the "quarantine" flag that, when set, refuses to run your binary until some extra security checks have been performed (checking against a malware database, asking the user for consent, etc). Once this check is done, the flag is unset.

Usually this flag has to be set by the app you use to download the binary - in most cases it would be the web browser, but here it would be Homebrew. They used to provide a --no-quarantine flag to prevent this bit from being set, but given some changes both in macOS and in the Homebrew project it's been decided to stop offering that option. You can still unset the flag by hand, no root required, but that's on you as a user.

I believe this is a strong nudge in the direction of "for a user-friendly experience you should sign your binaries", but not a full ban.

Post reply on HN