Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

201–210 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#201

Post by kragen »

yaris wrote: post #197
saagarjha wrote: post #120

Earlier quoted context omitted.

You can’t run unsigned software on Apple silicon. Note that when you build your software if you use Apple’s tools it will inject an ad-hoc signature into the product.

You very much _can_ run unsigned software on Apple silicon. At work my department has a bit less than 50 engineers with Macs (M1 to M4) and nobody complained that they can't build and run our product (using GCC from Homebrew, not Clang from Apple). But it involves some jumping through hoops, yes.

What are the hoops?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#202

Post by chii »

danudey wrote: post #81
seanparsons wrote: post #69

Earlier quoted context omitted.

The point is that by the time Gatekeeper closes tight enough that everything must run through Apple and it can't be disabled, most people wont notice and will be stuck with it.

Your assertion seems to imply that there will be a point of no return where users are no longer able to stop buying apple hardware to run the software they want, and that therefore people should do so now. If that's not what you're saying then your point is effectively moot, because if indeed Apple's platform control gets too egregious for some individuals then those people will switch at that point so there's no poi…

> more people will hit their own tipping point but asserting that it's going to happen all at once and apply to everyone is nonsense.

the point of boiling the frog is to make sure it happens slowly, such that the alternative options can no longer compete and be an option.

computer manufacturers and hardware makers cannot be trusted to make their platform open, because it would be detrimental to their bottom line. So it must come from regulation - right to repair etc, are on the right path, but what must be done is prevention of platform lockdowns. An owner of the hardware must be able to override all locks from the manufacturer.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#203

Post by yaris »

kragen wrote: post #201
yaris wrote: post #197

Earlier quoted context omitted.

You very much _can_ run unsigned software on Apple silicon. At work my department has a bit less than 50 engineers with Macs (M1 to M4) and nobody complained that they can't build and run our product (using GCC from Homebrew, not Clang from Apple). But it involves some jumping through hoops, yes.

What are the hoops?

As mentioned above you have to approve the binary two times (at least), being careful the first time because the dialog popup offers to remove the binary. Also since our product has some networking to do one has to mingle with firewall settings to allow the binary to do the networking.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#204

Post by GaryBluto »

jdxcode wrote: post #79
seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

I hate that analogy—frogs jump out.

I thought the problem with the analogy was that they died instantly?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#205

Post by soraminazuki »

SOLAR_FIELDS wrote: post #104
pxc wrote: post #59

Earlier quoted context omitted.

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> nixpkgs maintainers are hardline purists

On the contrary, Nixpkgs is generally made by the most pragmatic people and takes a flexible approach to a lot of issues. For instance, very few package managers have packages for proprietary software like 1Password in their official repositories. Nixpkgs also doesn't insist on building everything from source when it's hard to do so. As a result, Nixpkgs contains many packages for NPM or Maven projects. Other package managers insist on packaging all its dependencies from source, which is why they're struggling to package software written in modern programming languages.

As for 1Password, it works fine on NixOS. When installing proprietary GUI apps like 1Password on macOS, I just use Casks. I suspect many people do the same, which might lead to the 1Password package not working as well on macOS because fewer people bother with it.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#206

Post by ljm »

pxc wrote: post #59
devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew ex…

Spack is a really unfortunate name for a project given that it's a slur derived from 'spastic' in the UK.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#207

Post by kragen »

yaris wrote: post #203
kragen wrote: post #201

Earlier quoted context omitted.

What are the hoops?

As mentioned above you have to approve the binary two times (at least), being careful the first time because the dialog popup offers to remove the binary. Also since our product has some networking to do one has to mingle with firewall settings to allow the binary to do the networking.

I see, thanks!

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#208

Post by jlokier »

zackb wrote: post #139
marcodiego wrote: post #43

Earlier quoted context omitted.

Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.

Asahi Linux[1] is unbelievably great on Apple Silicon. It's honestly the best Linux install experience I've ever had. 1. https://asahilinux.org/

Unfortunately, while Asahi Linux runs fine on M1 and M2 with some missing capabilities, it doesn't run at all on M3, M4 or M5.

The M1 and M2 are still great laptops, so it's still a good experience if you're looking for a second-hand Linux laptop with Apple quality hardwre.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#209

Post by swiftcoder »

nixpulvis wrote: post #53

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature. https://github.com/alacritty/alacritty/issues/8749 Does anyone know if self-signed binaries will work?

It seems like all they have to do is add a post install script that clears the quarantine attribute?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#210

Post by wl »

Onavo wrote: post #55

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count). It's a pity the original author got lost in the crypto rabbit hole https://tea.xyz/ There's also Sps2 which is written in Rust but it's very early stage https://github.com/alexykn/sps2 Breaking the momentum and institutional adoption of homebrew is non-trivial but the…

Mike McQuaid has been doing this a long time and there are more egregious examples in the past. I got off the Homebrew train when Little Snitch caught Homebrew phoning home without my consent and the response from him was, the developers have already decided to implement telemetry in an opt-out fashion and any pushback to that already made decision is "abusive" to the maintainers.

The Homebrew maintainers are not trustworthy. Don't use their software. If a fork was going to be feasible, it already would have happened.

Post reply on HN