Shame on you, Homebrew, for effectively killing FOSS apps from casks.

you are viewing a single comment's thread
view the rest of the comments
[–] 45 points 1 year ago* (last edited 1 year ago) (9 children)

Their explanation as to why:

--no-quarantine is used to forcibly bypass Gatekeeper, which is a built-in macOS security mechanism. This is used to run unsigned/unnotarized applications.

macOS Tahoe is the final release to support Intel systems, and last year Apple updated macOS runtime protection to make it harder to override Gatekeeper. Macs with Apple silicon also don't "permit native arm64 code to execute unless a valid signature is attached". Finally, we are ending support for all casks that fail Gatekeeper checks on September 1st, 2026.

With the above in mind, it's time to deprecate the --no-quarantine flag from brew. It intentionally bypasses macOS security mechanisms, which we already actively discourage. Deprecating now will give a decent lead time for users using it to come up with another solution or adjust their workflows.

  • source
  • hideshow 9 child comments
  • [–] 32 points 1 year ago (8 children)

    Deprecating now will give a decent lead time for users using it to come up with another solution or adjust their workflows.

    The adjusted solution/workflow: use something other than homebrew

  • source
  • parent
  • hideshow 8 child comments
  • [–] 13 points 1 year ago (5 children)

    How will these other solutions bypass Apples quarantine?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 22 points 1 year ago* (last edited 1 year ago) (4 children)

    By doing what homebrew currently does when you pass the --no-quarantine flag, which is call xattr.

    Note that I'd probably support removing --no-quarantine if Apple's notarization service was free.

  • source
  • parent
  • hideshow 4 child comments
  • [+] 12 points 1 year ago (3 children)
  • [–] 8 points 1 year ago* (2 children)

    Yes, but you can still compile the code yourself. It's only problematic for binary distribution. This is basically a question of balancing security vs. freedom I suppose.

  • source
  • parent
  • hideshow 2 child comments
  • [+] 1 point 11 months ago (1 child)
  • [–] 0 points 11 months ago

    Difference is compiling an app from source for Android is not really feasible on Android devices, whereas doing so on macOS is literally built into the package managers for macOS and is generally pretty trivial beyond it taking more time.

    Also, macOS doesn't prevent you from running the apps entirely.

  • source
  • parent