4 ms·
Is there some way to have some faith from what you're getting from brew? In other words, can I verify installations from brew somehow?
by tolmasky 10y ago
Is there some way to have some faith from what you're getting from brew? In other words, can I verify installations from brew somehow?
- jesseendahl 10y agoYes, brew automatically checks that hashes of downloads match what was specified in the formula. This does mean you're trusting the formula maintainer(s), but anyone using brew is already doing that anyway. http://stackoverflow.com/a/25750690 http://stackoverflow.com/a/25750690
- jjn2009 10y ago>http://brew.sh/ http://brew.sh/ the home site shows a simple wget example for homebrew formulae the chain of trust is solid up until make and configure happen, at that point any number of things could happen so it's a question of whether or not you trust whatever scripts its running. unless homebrew has some sort of enforcement on what that script can do it could do anything. This is why its a really good thing that homebrew does not require root.
- mikemcquaid 10y ago> unless homebrew has some sort of enforcement on what that script can do Anything from our Homebrew/core (i.e. wget) uses the macOS sandbox to prevent writes outside of permitted locations.
- paultopia 10y agoFrankly, I am starting to have serious reservations about brew itself. It seems to now be forcing a self-update on every package installation, and that update somehow (I'm not a good enough *nix hacker to sort it out) gets some kind of elevated in the process privs: I've tried setting some of its component ruby scripts read-only and even changing ownership, and they still get force-updated on package installation.