4 ms·

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit

by lrvick 4y ago

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.

acdha 4y ago
If they were using signed binaries wouldn’t the same people who have permission to merge code have permission to sign compiled binaries (or, realistically, start a CI process which does)?
tasuki 4y ago
I've been using Linux for the past 18 years or so, but damn do the M1 macs look interesting. How does one manage packages on a mac?
- Squarex 4y ago
  you could use nix
  - nishanths 4y ago
    some more choices: MacPorts, pkgsrc
- Chiron1991 4y ago
  Excluding 3rd party tools like Homebrew, one dosn't. The native 'package manager' is the Apple App Store. You can also manually download and install .dmg files of applications (much like .deb or .rpm).
  - lockhouse 4y ago
    macOS also has .pkg installer packages that are native. The only issue is that there is no uninstall functionality built in to them unless the package provides their own. https://en.wikipedia.org/wiki/Installer_(macOS) https://en.wikipedia.org/wiki/Installer_(macOS)
    - mdaniel 4y ago
      That actually bugged me so much that I made a script to use the manifest to blow away declared files and dirs PKGID="${1:-}" PKG_ROOT="$(pkgutil --pkg-info "$PKGID" \ | awk -F: '/location:/{print $2}' \ | sed -e 's,^[ \t]*,/,')" pkgutil --only-files --files "$PKGID" \ | join_paths_0 "$PKG_ROOT" \ | xargs -0 $dry_run rm -v pkgutil --only-dirs --files "$PKGID" \ | sort -r \ | join_paths_0 "$PKG_ROOT" \ | xargs -0 $dry_run rmdir pkgutil --forget "$PKGID" It still leaves detritus, but is better than "oh well, guess I'm stuck with Rando Thing 0.9beta forever"
- dlivingston 4y ago
  With Homebrew, frankly. That's the Mac equivalent to apt. I've also had success with Anaconda (specifically, miniconda / miniforge) - it's not just for Python! It's great for creating disposable development environments (i.e., I need HDF5, but only for this project). Other than that, your toolchain is what Apple gives you, and upgrades in ~parity with XCode.
vorpalhex 4y ago
Don't install untrusted code on your machine or your machine may do untrusted things. If you're worried about it, compile your own builds.
- tasuki 4y ago
  > If you're worried about it, compile your own builds. You forgot an important part: If you're worried about it, compile your own builds, and read and fully audit all the code before compiling. Then upon every update, read and audit all the changes. I believe this is infeasible even for the tech giants.
woodruffw 4y ago
> Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. This is incorrect: Homebrew pins bottle and source installs to digests, meaning that you do have a strong integrity check each time you install a package. Homebrew does not currently do code signing, which is not particularly abnormal for non-Linux-distribution package managers (ask yourself when you last verified a PGP signature from PyPI). There are some plans in progress to remedy that but, in its absence, HTTPS and package digests are both reasonable and no worse than standard practice in packaging.
deleted 4y ago
[deleted]

by lrvick 4y ago

acdha 4y ago

If they were using signed binaries wouldn’t the same people who have permission to merge code have permission to sign compiled binaries (or, realistically, start a CI process which does)?

tasuki 4y ago

I've been using Linux for the past 18 years or so, but damn do the M1 macs look interesting. How does one manage packages on a mac?

Squarex 4y ago
you could use nix
- nishanths 4y ago
  some more choices: MacPorts, pkgsrc
Chiron1991 4y ago
Excluding 3rd party tools like Homebrew, one dosn't. The native 'package manager' is the Apple App Store. You can also manually download and install .dmg files of applications (much like .deb or .rpm).
- lockhouse 4y ago
  macOS also has .pkg installer packages that are native. The only issue is that there is no uninstall functionality built in to them unless the package provides their own. https://en.wikipedia.org/wiki/Installer_(macOS) https://en.wikipedia.org/wiki/Installer_(macOS)
  - mdaniel 4y ago
    That actually bugged me so much that I made a script to use the manifest to blow away declared files and dirs PKGID="${1:-}" PKG_ROOT="$(pkgutil --pkg-info "$PKGID" \ | awk -F: '/location:/{print $2}' \ | sed -e 's,^[ \t]*,/,')" pkgutil --only-files --files "$PKGID" \ | join_paths_0 "$PKG_ROOT" \ | xargs -0 $dry_run rm -v pkgutil --only-dirs --files "$PKGID" \ | sort -r \ | join_paths_0 "$PKG_ROOT" \ | xargs -0 $dry_run rmdir pkgutil --forget "$PKGID" It still leaves detritus, but is better than "oh well, guess I'm stuck with Rando Thing 0.9beta forever"
dlivingston 4y ago
With Homebrew, frankly. That's the Mac equivalent to apt. I've also had success with Anaconda (specifically, miniconda / miniforge) - it's not just for Python! It's great for creating disposable development environments (i.e., I need HDF5, but only for this project). Other than that, your toolchain is what Apple gives you, and upgrades in ~parity with XCode.

vorpalhex 4y ago

Don't install untrusted code on your machine or your machine may do untrusted things. If you're worried about it, compile your own builds.

tasuki 4y ago
> If you're worried about it, compile your own builds. You forgot an important part: If you're worried about it, compile your own builds, and read and fully audit all the code before compiling. Then upon every update, read and audit all the changes. I believe this is infeasible even for the tech giants.

woodruffw 4y ago

> Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. This is incorrect: Homebrew pins bottle and source installs to digests, meaning that you do have a strong integrity check each time you install a package. Homebrew does not currently do code signing, which is not particularly abnormal for non-Linux-distribution package managers (ask yourself when you last verified a PGP signature from PyPI). There are some plans in progress to remedy that but, in its absence, HTTPS and package digests are both reasonable and no worse than standard practice in packaging.

deleted 4y ago

[deleted]