Homebrew, de facto standard package manager for macOS, now forces Apple's $99/yr notarization bullshit for all casks.

Comments

• Korne127@lemmy.world ⁨1⁩ ⁨day⁩ ago

  removing macOS Gatekeeper bypass behaviours

  dafuq? That’s basically the entire point

  So yeah, there will be a fork soon that’s just compatible with the casks. Luckily that is very easily to do / manage

  source
• Jimmycrackcrack@lemmy.ml ⁨1⁩ ⁨day⁩ ago

  Et tu brew?

  source
• KoalaUnknown@lemmy.world ⁨1⁩ ⁨day⁩ ago

  Their explanation as to why:

  Verification

  • This issue’s title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at github.com/Homebrew/homebrew-core/…/choose instead.

  Provide a detailed description of the proposed feature

  –no-quarantine is used to forcibly bypass Gatekeeper, which is a built-in macOS security mechanism. This is used to run unsigned/unnotarized applications.

  macOS Tahoe is the final release to support Intel systems, and last year Apple updated macOS runtime protection to make it harder to override Gatekeeper. Macs with Apple silicon also don’t “permit native arm64 code to execute unless a valid signature is attached”. Finally, we are ending support for all casks that fail Gatekeeper checks on September 1st, 2026.

  With the above in mind, it’s time to deprecate the –no-quarantine flag from brew. It intentionally bypasses macOS security mechanisms, which we already actively discourage. Deprecating now will give a decent lead time for users using it to come up with another solution or adjust their workflows.

  What is the motivation for the feature?

  Intel support is coming to an end from both Apple and Homebrew. This flag is primarily used to override a macOS security mechanism, which we do not want to encourage. Since we are requiring casks fulfill Gatekeeper checks next year, there is no reason to keep this flag.

  How will the feature be relevant to at least 90% of Homebrew users?

  We will provide a safer experience for our users, and stop making it easier to bypass OS-level security.

  What alternatives to the feature have been considered?

  None. Macs with Apple silicon are the platform that will be supported in the future, and Apple is making it harder to bypass Gatekeeper as is.

  source

  • arcterus@piefed.blahaj.zone ⁨1⁩ ⁨day⁩ ago

    Deprecating now will give a decent lead time for users using it to come up with another solution or adjust their workflows.

    The adjusted solution/workflow: use something other than homebrew

    source

    • lepinkainen@lemmy.world ⁨1⁩ ⁨day⁩ ago

      How will these other solutions bypass Apples quarantine?

      source

      • -> View More Comments
    • dreadbeef@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

      I mean, theres macports and what else? Is macports even kickin still? No other package managers other than homebrew

      source

      • -> View More Comments
• plz1@lemmy.world ⁨1⁩ ⁨day⁩ ago

  Heh, there goes Librewolf’s only sane updating mechanism. IIRC, the devs of that are vehemently against paying Apple the money to sign the code, and they also fail to provide their own updater. It was one of the main drivers behind my switch to Waterfox.

  source
• piyuv@lemmy.world ⁨1⁩ ⁨day⁩ ago

  github.com/Homebrew/brew/issues/20755#issuecommen…

  In the end, the whole point of Gatekeeper is to protect end users as much as reasonable, and continuing to make it easy to bypass isn’t a good thing in my view.

  Whole point of Gatekeeper is Apple policing users’ devices. The security benefit is just a side effect. If anything, users need to be protected from Apple more than small time hackers.

  This is a shame. Big tech brain is affecting developers everywhere.

  Controversial opinion: best way to learn fire will burn you is to try and see. I personally learned a lot about computers by infecting my machine with a shitton of malware when I was a kid. Modern parents are very adamant on letting kids run free and learn stuff by themselves, why not apply the same logic to computers?

  source
• Chaser@lemmy.zip ⁨1⁩ ⁨day⁩ ago

  May be a sign to install Linux 😏 brew sucks anyways

  source

  • stupidcasey@lemmy.world ⁨1⁩ ⁨day⁩ ago

    True but I desperately need no compatibility, closed source, AppleCare, expensive hardware, limited lifespan, lock in … What did you call it Linux?

    source

    • turbowafflz@lemmy.world ⁨17⁩ ⁨hours⁩ ago

      It’s crazy how bad software compatibility on macos is. I used to assume it was about the same or slightly better than linux in that regard, but my attempts to help my friend play games on macos have almost entirely failed despite the fact that I have tons of experience playing games on linux since it’s always been my main os

      source
  • chocrates@piefed.world ⁨1⁩ ⁨day⁩ ago

    I'm stuck with it at work. Plus Linux usually sucks on Mac for a long time while drivers get written

    source

    • monogram@feddit.nl ⁨1⁩ ⁨day⁩ ago

      Put your money where your mouth is and donate to Asahi Linux.

      source

      • -> View More Comments
    • 6nk06@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

      MacPorts has always been better.

      source

      • -> View More Comments
    • Chaser@lemmy.zip ⁨1⁩ ⁨day⁩ ago

      I feel you. Once I was forced to code on a mac too. It made me insane ☠️

      source

      • -> View More Comments
  • ianonavy@lemmy.world ⁨1⁩ ⁨day⁩ ago

    If Brew sucks, why is it the preferred package manager for CLI tools in Bazzite?

    source

    • Chaser@lemmy.zip ⁨22⁩ ⁨hours⁩ ago

      I don’t use Bazzite. But if you have any pro arguments for Brew, feel free to share them. Change my mind.

      source

      • -> View More Comments
• CocaineShrimp@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

  I don’t think this is homebrews fault? It looks like apps need to be signed to run on apple silicone.

  source

  • noahimesaka1873@lemmy.funami.tech ⁨1⁩ ⁨day⁩ ago

    Yes and no. Yes, it has to be signed, but no, it doesn’t have to be Apple’s signing, it can be ad-hoc signed for the device programmatically. What they’re doing is that removing that ability to remove quarantine bits and ad-hoc signing on installation and forcing everything to be Apple-signed.

    source
  • mectag@lemmy.world ⁨1⁩ ⁨day⁩ ago

    [deleted]

    source

    • noahimesaka1873@lemmy.funami.tech ⁨1⁩ ⁨day⁩ ago

      100% their fault since there’s a way to ad-hoc sign and run, and they’re removing it and sucking Apple’s dick.

      source
• brax@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

  But I thought Mac was just Linux for people who loved to spend money… Seems on brand to me.

  source

  • Appoxo@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

    *Unix

    source

    • SaltySalamander@fedia.io ⁨1⁩ ⁨day⁩ ago

      **BSD

      source

      • -> View More Comments
  • noahimesaka1873@lemmy.funami.tech ⁨1⁩ ⁨day⁩ ago

    That’s why I buy Macs! /hj (Though I do install and use Arch BTW on my M2 MacBook Air)

    source

    • dan69@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Only arch users say that.

      source

      • -> View More Comments
• MissingInteger@lemmy.zip ⁨1⁩ ⁨day⁩ ago

  The unsigned (FOSS) Apps aren’t removed yet. They will be removed by 2026-09-01. Removing --no-quarantine before that seems counter productive. And quite frankly removing unsigned Apps at all seems like a stupid idea. Homebrew is a third party package mamager, why are they precapitulating to Apple?
  Third party taps (or are they fourth party?) will step in. You can run xattr -d com.apple.quarantine in the .rb file.

  Relevant links.

  • Homebrew Github Discussion about unsigned app removal.
  • How Freetube bypasses the issue in their own tap.

  source
• woelkchen@lemmy.world ⁨18⁩ ⁨hours⁩ ago

  Homebrew could provide their own casks of FOSS applications, compiled on their infrastructure and signed by their key. It’s kinda what F-Droid does on phones.

  source
• masterspace@lemmy.ca ⁨22⁩ ⁨hours⁩ ago

  Code signing should be done though.

  You can disagree with Apple’s approach that maintains them as the only signing authority, but, at a fundamental level, code signing is the only way to distribute an executable and have the user be able to trust who authored it and what’s in it.

  source
• henfredemars@lemdro.id ⁨1⁩ ⁨day⁩ ago

  What a shame. It’s probably my favorite tool on the platform.

  source
• sem@piefed.blahaj.zone ⁨1⁩ ⁨day⁩ ago

  What does this mean?

  source

  • KoalaUnknown@lemmy.world ⁨1⁩ ⁨day⁩ ago

    Apps have to be signed to be installed.

    source

    • lepinkainen@lemmy.world ⁨1⁩ ⁨day⁩ ago

      You can still install and run them but you need to manually him through the startup hoops once

      source
  • GreenKnight23@lemmy.world ⁨1⁩ ⁨day⁩ ago

    if you use a Mac git gud.

    source
• mumblerfish@lemmy.world ⁨1⁩ ⁨day⁩ ago

  I never understood what a “cask” in the brew lanuage means. I just do installs and if the brew install instructions involves a cask I just do it. How do I figure out which packages this will have an effect on on my system?

  source

  • SuperUserDO@piefed.ca ⁨1⁩ ⁨day⁩ ago

    Casks are as a rule GUI applications. So if you want to install Firefox with homebrew would need to install it via a cask.

    source
  • WhatAmLemmy@lemmy.world ⁨1⁩ ⁨day⁩ ago

    brew list --cask
    

    I think they’ve started flagging unnotarized apps as (deprecated), so maybe do a brew info on each.

    source

    • MissingInteger@lemmy.zip ⁨6⁩ ⁨hours⁩ ago

      You can simply run brew doctor and it will show you all deprecated casks.

      source
• natecox@programming.dev ⁨1⁩ ⁨day⁩ ago

  Well, I’m pretty happy that I’ve moved most of my app downloads to a nix config I guess.

  Seems like a bigger change than deserves to be buried in the changelog. I wonder what the intent here is.

  source
• myfunnyaccountname@lemmy.zip ⁨1⁩ ⁨day⁩ ago

  Of the like 30 things I have installed through brew, 1 is not signed. Do I agree with the change, no. But there are other options out there.

  source
• cv_octavio@piefed.ca ⁨1⁩ ⁨day⁩ ago

  Fuck homebrew mise cru for life now.

  source