Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

github.com

Post reply on HN
Print view View original

51–60 of 301 posts

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#51

Post by tom_ »

kragen wrote: post #36
tom_ wrote: post #34

Earlier quoted context omitted.

There'll be some way to make it work, possibly indeed that the Homebrew people get approved by Apple, because MacPorts works ok, and it seems to be downloading precompiled binaries (and if it isn't, then my Mac is actually faster than I've ever seen it run). And if MacPorts can do it, presumably Homebrew can do it too. Building stuff yourself remains an option, even if you're unapproved. The toolchain pops the codesi…

I see, thanks! Is cc installed by default? I remember when my ex-wife had a Mac she had to sign up for Apple's developer program to get compilers installed.

No idea what you get out of the box, or what /usr/bin/cc actually is and does, but it looks like the underlying compiler is the clang that came with Xcode, which I installed from the app store. I do have an Apple account, but I don't think it's signed up to Apple's developer program... at least, probably not? I'm not paying them for this, anyway.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#53

Post by nixpulvis »

Alacritty is seemingly affected by this, which sucks for people who install it from homebrew because there's no way the developers are going to shell out to Apple for the signature.

https://github.com/alacritty/alacritty/issues/8749

Does anyone know if self-signed binaries will work?

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#54

Post by woodruffw »

kragen wrote: post #35
woodruffw wrote: post #21

Earlier quoted context omitted.

> Does this mean people won't be able to use Homebrew to compile software from source (and run it)? Does it mean that they'll be able to use Homebrew to compile software from source, but not download prebuilt binaries (and run them)? No, and no. This only affects Casks, which are prebuilt .app bundles that Homebrew has no part in building (either locally or remotely). Formulae (source builds) and bottles (builds of f…

Can any random person build things from source, or do they need to be blessed by Apple?

The answer to this is nuanced because of how it works, but the short answer is yes: you can build random things from source and run them, and you can download random binaries from the internet and run them. The only thing that Homebrew itself is changing is that it no longer provides an automatic way to lift the quarantine bit from a specific subset of binary packages (casks).

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#55

Post by Onavo »

Anyone interested in forking homebrew? Seems like they need more competition when it comes to user friendly package managers (macports doesn't count).

It's a pity the original author got lost in the crypto rabbit hole

https://tea.xyz/

There's also Sps2 which is written in Rust but it's very early stage

https://github.com/alexykn/sps2

Breaking the momentum and institutional adoption of homebrew is non-trivial but the developer community needs to band together unless we want to be slaves to Apple's whims forever. The current homebrew maintain Mike McQuaid clearly had no interest in listening to users.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#56

Post by bluescrn »

buildfocus wrote: post #28

The contrast between the steadily shrinking freedoms in Apple-land and the open computing approach underlying all today's the Valve announcements is fascinating.

Yet Valve have still managed to maintain a dominant 'App Store' without having to rely on locked-down platforms.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#57

Post by none_to_remain »

mzajc wrote: post #20

It seems the maintainers are very eager to lock issues and threads on GitHub that receive any pushback to this decision. Where is this coming from? I thought Homebrew was pro-user software, which requiring Apple's approval to run software on my computer is ostensibly not.

The user's name is Tim Cook and it's very rude to use his computer in ways he wouldn't like

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#59

Post by pxc »

devkit1 wrote: post #24

If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…

> Most people I know are not installing too many casks

Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software.

I use Homebrew exclusively tucked away in isolated prefixes, only to install casks, and without ever putting any binaries it installs along the way on my PATH. I don't remember which programs it is, exactly, but I do use a few that are unsigned.

It also doesn't seem to me that the signing process is as vital in determining actual risk as the curation and moderation processes involved in maintaining "third-party" software distributions like Homebrew or Debian or whatever.

`--no-quarantine` in particular is one of the conveniences that makes Homebrew casks useful. If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell.

Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software

#60

Post by Onavo »

0xbadcafebee wrote: post #42

Homebrew is famous for making life hard for users. It makes "design decisions" that often conflict with users' needs, all in order to live up to the personal preferences of the project leads. Personally I use asdf to manage my software on Macs. It too has also changed its design recently to become user-hostile (the command-line tool no longer prints the options for the commands, and it's full of bugs since a recent m…

Try mise

https://mise.jdx.dev/dev-tools/comparison-to-asdf.html

Post reply on HN