[dead]
Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
71–80 of 301 posts
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#72If I understand the issue correctly, it appears that this change primarily impacts casks on macOS. In fact it looks like it may only impact casks. Casks are used to install binary packaged software, often in the form of a dmg or pkg file on macOS. Most people I know are not installing too many casks, and most of the ones I've seen install signed binaries anyway. The important thing for me with this is that it doesnt…
casks are mostly for GUI or other apps that need special installation like setting up background services. I've seen it used for IT laptop provisioning to automate the installation of things like Chrome, Slack, Visual Studio, from the command line.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#73TL;DR
Homebrew is removing --no-quarantine because:
Apple is killing Intel support.
Apple Silicon won’t run unsigned apps anyway.
Homebrew will soon require all apps to pass Gatekeeper.
They don’t want to help users bypass macOS security.
This is basically a security + future-compatibility cleanup.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#74Can someone explain why disallowing Gatekeeper bypass via Homebrew is related to macOS disallowing unsigned ARM64 binaries to run? My understanding is that `—no-quarantine` just removes the `com.apple.quarantine` attribute from a downloaded application. If the application is unsigned then removing the attribute wouldn’t allow it to run anyways. There’s no way to disable the signature check because it’s a kernel level check. However, macOS will accept an adhoc signature. Because of this, to me it seems like Gatekeeper bypass and unsigned software are orthogonal topics. No matter if I remove the Gatekeeper signature or not, unsigned code still won’t run unless I add an adhoc signature. On the other hand, if I distribute software with an adhoc signature, macOS wouldn’t prevent someone else from running it as long as they remove the quarantine attribute. Am I missing something?
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#75Earlier quoted context omitted.
I see, thanks! Is cc installed by default? I remember when my ex-wife had a Mac she had to sign up for Apple's developer program to get compilers installed.
You don't need to sign up for a developer program, or even download the full Xcode IDE. You do need to install the compiler tools with xcode-select --install
I see, thanks! That clarifies things a lot.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#76Earlier quoted context omitted.
Can any random person build things from source, or do they need to be blessed by Apple?
The answer to this is nuanced because of how it works, but the short answer is yes: you can build random things from source and run them, and you can download random binaries from the internet and run them. The only thing that Homebrew itself is changing is that it no longer provides an automatic way to lift the quarantine bit from a specific subset of binary packages (casks).
I see, thanks!
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#77Earlier quoted context omitted.
Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.
I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.
> they literally don't do anything to prevent you from running another OS.
Like not documenting their hardware? Like making Asahi Linux becoming a multi-year reverse engineering project that may possibly never achieve perfect compatibility?
> They make it easy to run Windows
On apple silicon without virtualisation? Sorry, didn't know that.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#78Earlier quoted context omitted.
As I understand it `--no-quarantine`, as it is currently implemented, is a noop on ARM Macs. So if Homebrew has two options: 1. Play cat and mouse with Apple to ensure `--no-quarantine` works 2. Deprecate and remove the feature.
Well, 2. is what the people are asking for but aren't getting. They want deprecation and a ENV flag to enable. It'd be enough. But even that isn't being allowed which is weird for a power-user program. I can't help but think, "Don't obey in advance."
2 is what is happening. The feature is being deprecated and will likely be removed in the next MacOS version.
>I can't help but think, "Don't obey in advance."
They aren't obeying in advance. They simply aren't doing the work to find another Gatekeeper bypass for ARM64.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#79My longstanding prediction that Gatekeeper will ever so slowly tighten so that people don't realise like a frog boiled in water is continuing to be true.
I hate that analogy—frogs jump out.
Re: Homebrew no longer allows bypassing Gatekeeper for unsigned/unnotarized software
#80Earlier quoted context omitted.
Apple does not support running other OS's on their hardware. This is bad in many senses but it is specially bad since it weakens competition and reduces incentives for Apple to improve their own OS, meaning it is bad even for their users in the long run. If you choose to buy hardware from apple, you must consider that you're encouraging a behaviour that is bad for everyone, including yourself.
I'm not sure what you're talking about. Their bootloader explicitly supports other OSes. They make it easy to run Windows (even through a built-in app that helps you set it up). There are plenty of reasons to criticize Apple, but they literally don't do anything to prevent you from running another OS.
> Their bootloader explicitly supports other OSes
That’s true but that’s probably only so that it wouldn’t have been a subject when Apple Silicon Macs were released because Intel Macs weren’t locked.
In reality, the bootloader isn’t closed (yet) but the hardware is so much undocumented that it’s easy to understand that Apple doesn’t want anything else than their OS on your mac. The « alternative os » situation is actually worse than it used to be with Intel Macs and Apple is paying a lot of attention in never talking about this "feature".
IMO, they will just quietly remove this possibility on new generations when everyone will have forgotten that boot camp used to be a thing.