Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

271–280 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#271

Post by marcprux »

noname120 wrote: post #270
mikemcquaid wrote: post #185

Earlier quoted context omitted.

Homebrew Project Leader here. Yes, this only affects casks, not formulae, whether formulae are built from source or use Homebrew's bottles (binary packages) or bottles from taps.

As an open-source developer, is there a way to have my apps pass Gatekeeper without paying the $100/year Apple ransom and notarizing them? I think it’s the crux of the problem. As I’m writing these lines, Homebrew has 7656 casks in the official cask tap[1]. I’m not sure exactly how many of those are unsigned but if we assume 4000 then signing them all would be an additional $400,000/year extorted by Apple from the op…

You can make your own tap (which is just a GitHub repo) and manually clear the quarantine flag in a postflight step. E.g., see https://github.com/alacritty/alacritty/issues/8749

Users will need to `brew install myorg/mytap/appname` instead of just `brew install appname`, but I think that's the only real option at this point.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#272

Post by usernamed7 »

mikemcquaid wrote: post #223
usernamed7 wrote: post #216

Earlier quoted context omitted.

> As to me being a dick: I've been maintaining Homebrew for 16 years. It's used by millions of people. My full-time job has never been doing so and I've never been paid a market rate for my work on it (not that I expect or perhaps even deserve so). My primary concern with Homebrew is keeping the project actually running. This primarily requires the time, energy and work of maintainers doing so in their free time. It…

I don't think I am a dick, I guess that went without saying. I'll take critique from other maintainers who have done as much or more open source work for similar returns over similar time periods. Funnily enough, I'm friends with many, and they are supportive the vast majority of the time instead of critical. Maybe that's because they can relate and you cannot.

> Maybe that's because they can relate and you cannot.

Now you're deflecting. I passed no judgement i made an observation of your statement and you took it personally.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#273

Post by theoldgreybeard »

DavideNL wrote: post #196
theoldgreybeard wrote: post #19

This has turned into a such a pain point for me I'm probably just going to ditch MacOS on my next hardware refresh and insist on a Linux-based workstation. I already use Linux for everything else, changing for $DAY_JOB is trivial.

Meanwhile, just automatically remove the quarantine attribute: https://news.ycombinator.com/item?id=45913209

If I’m gonna bother doing something like that I’m just gonna use Linux and just not have to deal with it at all.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#274

Post by devkit1 »

soraminazuki wrote: post #205
SOLAR_FIELDS wrote: post #104

Earlier quoted context omitted.

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for t…

> nixpkgs maintainers are hardline purists On the contrary, Nixpkgs is generally made by the most pragmatic people and takes a flexible approach to a lot of issues. For instance, very few package managers have packages for proprietary software like 1Password in their official repositories. Nixpkgs also doesn't insist on building everything from source when it's hard to do so. As a result, Nixpkgs contains many packag…

The 1Password cask will almost certainly continue to work. 1Password distributes a signed installer.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#275

Post by CGamesPlay »

pbronez wrote: post #234
CGamesPlay wrote: post #111

Earlier quoted context omitted.

The linking step isn't even required. You can download any existing binary and codesign it yourself with your local developer certificate. You can even overwrite the existing signature. I assume brew could even automate this, but are choosing not to for whatever reason.

If Homebrew auto-signed third-party code, that puts them on the line for the security of that code. The whole point of MacOS developer certificates is to increase the trustworthiness of the software you run on your machine. The trust comes from the formal relationship between Apple and the software developer, which includes a traceable financial transaction. If signed software proves to be malicious, attribution is t…

Yeah, makes sense Homebrew doesn't sign everything with their own certs. I was suggesting that Homebrew could run codesign locally with the user's local certificate as part of the install process.

> The bad actors would flood homebrew with malicious binaries, which homebrew would auto-sign, users would download & run, and the bad actors would laugh all the way to the bank.

Every software distributor has this problem, code-signed or not. This is either already happening to Homebrew (and not using code signing) or there's some other reason that it isn't happening.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#276

Post by DavideNL »

shantara wrote: post #180
theoldgreybeard wrote: post #118

Earlier quoted context omitted.

I actually tried to install Librewolf today and it wouldn’t go because of gatekeeper. Ended up on Waterfox instead. Would’ve preferred Librewolf because that’s what I run on my other desktop running Linux but what can you do…

You can still use Librewolf, if you manually remove the quarantine attribute after every update and reboot. It’s very annoying, but at least it’s possible for now xattr -dr com.apple.quarantine /Applications/LibreWolf.app

...or automatically remove the quarantine attribute: https://news.ycombinator.com/item?id=45913209

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#277

Post by yaris »

john_alan wrote: post #252
kragen wrote: post #207

Earlier quoted context omitted.

I see, thanks!

this is completely false, compile a binary strip the signature and see for yourself. AS requires code sign with adhoc, minimum.

To check I did this: removed the signature (LC_CODE_SIGNATURE section) using lief Python package (no affiliation, just looked suitable for the task), checked by otool that the section is indeed gone, started the binary - it worked. The spctl said that the binary is "rejected", but it says so about every non-Apple binary I checked on my machine so not informative. The codesign tool shows "is not signed at all" on the binary with stripped signature. I'm not too well-versed in OSX system/dev tools, so if there is a more correct/precise method of checking the signatures I'd very much like to know.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#278

Post by john_alan »

yaris wrote: post #277
john_alan wrote: post #252

Earlier quoted context omitted.

this is completely false, compile a binary strip the signature and see for yourself. AS requires code sign with adhoc, minimum.

To check I did this: removed the signature (LC_CODE_SIGNATURE section) using lief Python package (no affiliation, just looked suitable for the task), checked by otool that the section is indeed gone, started the binary - it worked. The spctl said that the binary is "rejected", but it says so about every non-Apple binary I checked on my machine so not informative. The codesign tool shows "is not signed at all" on the…

hmmm this is really bizarre.

are you running < 15.1?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#279

Post by Mashimo »

walthamstow wrote: post #217
Mashimo wrote: post #198

Earlier quoted context omitted.

Probably not if you bought the 8GB version :D

My 8GB M1 Air is still running as well today as the day I bought it.

And it will run at the same speed. But I would guess a lot of apps will requier more ram at some point.

OP said it should last for " at least 5 years from now, if not more." which I doubt. Maybe for light webbrowsing.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#280

Post by noname120 »

marcprux wrote: post #271
noname120 wrote: post #270

Earlier quoted context omitted.

As an open-source developer, is there a way to have my apps pass Gatekeeper without paying the $100/year Apple ransom and notarizing them? I think it’s the crux of the problem. As I’m writing these lines, Homebrew has 7656 casks in the official cask tap[1]. I’m not sure exactly how many of those are unsigned but if we assume 4000 then signing them all would be an additional $400,000/year extorted by Apple from the op…

You can make your own tap (which is just a GitHub repo) and manually clear the quarantine flag in a postflight step. E.g., see https://github.com/alacritty/alacritty/issues/8749 Users will need to `brew install myorg/mytap/appname` instead of just `brew install appname`, but I think that's the only real option at this point.

I’m worried app maintainers will start to indiscriminately run xattr -d no matter if the user actually wants that or not. There will not be any kind of standard way to do that so the experience will be very inconsistent between casks…

I hope Homebrew will start supporting hooks at a later point because it would allow users to automatically de-quarantine instead of having all maintainers add xattr -d garbage commands to all their casks.

Post reply on HN