Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

31–40 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#31

Post by tacker2000 »

anamexis wrote: post #22
tacker2000 wrote: post #14

Homebrew is not really pro in any way: they force updates, deprecate old software that is still widely in use, the maintainers are always very combative and dont allow any discussions or other opinions. In the end it's a package manager for consumers that hand holds you and is not really useful in a pro context. I've been meaning to jump to macports anyway, maybe ill do it now...

What is the pro vs consumer distinction here? What consumers use homebrew?

im talking about developers for example, that may need specific/old versions of php or node or whatever, which then get deprecated and uninstallable via brew as soon as they officially reach EOL. Or once installed, get forcefully and inadvertently updated by brew.

On the other side is some consumer who uses brew to install youtube downloader and doesnt care about versions/upgrades, etc...

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#32

Post by woodruffw »

skygazer wrote: post #26

Hmm. I use arm64 macports instead of homebrew, and as far as I know, I download prebuilt binaries from macports without issue even on Tahoe -- are they signing them with an approved account? Or did they force me to build everything from scratch, like the old days, and I haven't noticed?

This doesn't affect most prebuilt binaries. It specifically affects what Homebrew calls "casks," which are redistributions of .app bundles (which come with additional restrictions via Gatekeeper, unlike a "simple" binary).

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#33

Post by bbkane »

seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

Fortunately, Linux laptops are getting better and better. I'm hopeful that by the time my M1 macBook Air gets slow enough to annoy me (maybe a year or two from now?), I'll be able to smoothly transition to Linux. I've already done it on the desktop!

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#34

Post by tom_ »

kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

There'll be some way to make it work, possibly indeed that the Homebrew people get approved by Apple, because MacPorts works ok, and it seems to be downloading precompiled binaries (and if it isn't, then my Mac is actually faster than I've ever seen it run). And if MacPorts can do it, presumably Homebrew can do it too.

Building stuff yourself remains an option, even if you're unapproved. The toolchain pops the codesign step in at some point, I guess, and if you built it locally then you can run it locally. I just did cc -o on some bit of code on an Apple Silicon Mac, and the resulting binary did run.

(You can also run binaries that unapproved people built on other systems, but it's a minor pain, as you have to explicitly opt in to allowing each runnable file to run.)

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#35

Post by kragen »

woodruffw wrote: post #21
kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

> Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? No, and no. This only affects Casks, which are prebuilt .app bundles that Homebrew has no part in building (either locally or remotely). Formulae (source builds) and bottles (builds of f…

Can any random person build things from source, or do they need to be blessed by Apple?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#36

Post by kragen »

tom_ wrote: post #34
kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

There'll be some way to make it work, possibly indeed that the Homebrew people get approved by Apple, because MacPorts works ok, and it seems to be downloading precompiled binaries (and if it isn't, then my Mac is actually faster than I've ever seen it run). And if MacPorts can do it, presumably Homebrew can do it too. Building stuff yourself remains an option, even if you're unapproved. The toolchain pops the codesi…

I see, thanks! Is cc installed by default? I remember when my ex-wife had a Mac she had to sign up for Apple's developer program to get compilers installed.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#37

Post by simonw »

tacker2000 wrote: post #31
anamexis wrote: post #22

Earlier quoted context omitted.

What is the pro vs consumer distinction here? What consumers use homebrew?

im talking about developers for example, that may need specific/old versions of php or node or whatever, which then get deprecated and uninstallable via brew as soon as they officially reach EOL. Or once installed, get forcefully and inadvertently updated by brew. On the other side is some consumer who uses brew to install youtube downloader and doesnt care about versions/upgrades, etc...

If you are a developer who needs a specific old version of PHP or Node or whatever and you're not using Docker then I have great news for you on how you can solve your problem.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#38

Post by tacker2000 »

mzajc wrote: post #20

It seems the maintainers are very eager to lock issues and threads on GitHub that receive any pushback to this decision. Where is this coming from? I thought Homebrew was pro-user software, which requiring Apple's approval to run software on my computer is ostensibly not.

if you read any old issues on the homebrew github you can see how these maintainers are always very aggressive and anti-discussion, especially the main guy.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#39

Post by superkuh »

probably_wrong wrote: post #30
kragen wrote: post #3

I don't understand what this means, although I've read the whole thread. Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? Does it mean that they'll be able to download prebuilt binaries, but only run them if they're built by a developer…

This is my understanding after a moderate dive into the issue. Binaries in macOS have a signature and a set of flags. One of those flags is the "quarantine" flag that, when set, refuses to run your binary until some extra security checks have been performed (checking against a malware database, asking the user for consent, etc). Once this check is done, the flag is unset. Usually this flag has to be set by the app yo…

Or more explicitly, "for a user-friendly experience you should pay apple and ask them please to sign your binaries every year"

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#40

Post by armchairhacker »

seanparsons wrote: post #4

My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.

People did realize when the actual Gatekeeper change happened a year ago [1]. But your prediction still holds because frogs do realize when they're boiled in water [2].

[1] https://arstechnica.com/gadgets/2024/08/macos-15-sequoia-mak..., https://www.macrumors.com/2024/08/06/macos-sequoia-gatekeepe..., https://daringfireball.net/linked/2024/08/07/mac-os-15-sequo.... Top HN comment on Sequoia's announcement mentions it: https://news.ycombinator.com/item?id=41559761

[2] https://en.wikipedia.org/wiki/Boiling_frog#Experiments_and_a...

Post reply on HN