5 ms·

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't relia

by pxc 11mo ago

> Most people I know are not installing too many casks Casks are the only things Homebrew does that some other package manager available on macOS doesn't reliably do better. Nix, Pkgsrc, MacPorts, and (and now Spack) all have better fundamental designs; sane, multi-user-friendly permissions; and enough isolation from the base system that they break neither each other nor manually-installed software. I use Homebrew exclusively tucked away in isolated prefixes, only to install casks, and without ever putting any binaries it installs along the way on my PATH. I don't remember which programs it is, exactly, but I do use a few that are unsigned. It also doesn't seem to me that the signing process is as vital in determining actual risk as the curation and moderation processes involved in maintaining "third-party" software distributions like Homebrew or Debian or whatever. `--no-quarantine` in particular is one of the conveniences that makes Homebrew casks useful. If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell.

lilyball 11mo ago
I haven't used Homebrew in a long time, but if I ever did it would be in the way that you describe (so far I've always found reasonable alternatives for the software I want). What I'm wondering is if this is entirely to support unsigned casks, why does Homebrew not simply resign the software itself at install time with an adhoc signature as though it had just built it?
zbentley 11mo ago
> If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell. Really? That's a whole lot of UI actions/clicks (and a variable number per .app) versus ... I think two always-the-same UI actions at most. Not like, a huge hassle either way, but I have trouble seeing how Homebrew's not still the winner here even without quarantine bypassing.
alwillis 11mo ago
> Most people I know are not installing too many casks I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas. As of today, I have 44 casks. [1]: https://docs.brew.sh/Brew-Bundle-and-Brewfile https://docs.brew.sh/Brew-Bundle-and-Brewfile
- fastily 11mo ago
  I do something similar. I bootstrap all my new installs with brew cask https://github.com/fastily/autobots/tree/master/macOS/setup https://github.com/fastily/autobots/tree/master/macOS/setup
  - incanus77 11mo ago
    Same here.
    - sleepybrett 11mo ago
      Probably easy enough to write a script that will iterate that list and run the proper xattr command to remove each from quarantine.
  - setopt 11mo ago
    I bootstrap it using Brewfile (plaintext file read by Homebrew), which supports Casks too.
SOLAR_FIELDS 11mo ago
Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for that > softwareD # ostensibly available in nixpkgs, but the package is completely broken (more general case of 1password) Why not wrap the binaries yourself in flake.nix you say? Well, sure, would love to, if it wasn't such a pain in the ass to do so for each one and keep them up to date.
- pxc 11mo ago
  Brew-Nix might be able to cover some of those gaps, but probably not all of them. But almost certainly SoftwareC, at least! https://github.com/BatteredBunny/brew-nix https://github.com/BatteredBunny/brew-nix
  - SOLAR_FIELDS 11mo ago
    What he is doing in there is kinda cool but the trampoline app solution is quite similar and unfortunately does not fix this problem. Fundamentally the problem is that when you install stuff with nix it gets a folder that is unique to that nix generation. That is by design nix, because you want to be able to go back and forth between generations etc. Apple does not think of things the same way. Applications is a single folder that you can’t subdivide with iterations and it’s “speshul”. These core philosophies are antithetical to each other. This is fine for Most applications who don’t need to be in Applications. You let Nix install into its own little /nix/ generation folder and then create a “trampoline” in applications which is basically like a symlink. Then your app shows up in spotlight etc. where this falls apart is applications like 1Password that MUST boot from the speshul Applications folder However, you are right, it definitely makes some other pieces of this cleaner. In particular, if you just use homebrew directly with nix, you aren't deterministic or reproducible. You have an impure setup because if you remove a cask from the list, it doesn't actually delete it from homebrew, and you can't go back and forth with generations because homebrew is stuffing things in /applications. The project you linked forces brew stuff to behave like Nix applications and go in /nix instead, which allows it to be able to walk between generations. So it solves most of the issues with brew and nix but not all of them.
ljm 11mo ago
Spack is a really unfortunate name for a project given that it's a slur derived from 'spastic' in the UK.
- pxc 11mo ago
  Can you just "pronounce" it (even in your head) S-pack, as in "source package"?

by pxc 11mo ago

lilyball 11mo ago

I haven't used Homebrew in a long time, but if I ever did it would be in the way that you describe (so far I've always found reasonable alternatives for the software I want). What I'm wondering is if this is entirely to support unsigned casks, why does Homebrew not simply resign the software itself at install time with an adhoc signature as though it had just built it?

zbentley 11mo ago

> If I have to give my consent anew for each app update, I might as well install the apps manually and live in the usual auto-update pop-up hell. Really? That's a whole lot of UI actions/clicks (and a variable number per .app) versus ... I think two always-the-same UI actions at most. Not like, a huge hassle either way, but I have trouble seeing how Homebrew's not still the winner here even without quarantine bypassing.

alwillis 11mo ago

> Most people I know are not installing too many casks I did a wipe and install of Tahoe like 2–3 weeks ago and used a Brewfile [1] I've had for years to install ~30 casks via Homebrew, including from the App Store, not to mention 50-60 formulas. As of today, I have 44 casks. [1]: https://docs.brew.sh/Brew-Bundle-and-Brewfile https://docs.brew.sh/Brew-Bundle-and-Brewfile

fastily 11mo ago
I do something similar. I bootstrap all my new installs with brew cask https://github.com/fastily/autobots/tree/master/macOS/setup https://github.com/fastily/autobots/tree/master/macOS/setup
- incanus77 11mo ago
  Same here.
  - sleepybrett 11mo ago
    Probably easy enough to write a script that will iterate that list and run the proper xattr command to remove each from quarantine.
- setopt 11mo ago
  I bootstrap it using Brewfile (plaintext file read by Homebrew), which supports Casks too.

SOLAR_FIELDS 11mo ago

Yeah, my nix-darwin config is pretty nice and perfectly hermetic and reproducible, save for a now-growing list of casks in my brew.nix that looks like this: > 1password # breaks in nix, must go in /Applications folder > softwareB # not available in nixpkgs > softwareC # available in nixpkgs, but because nixpkgs maintainers are hardline purists it takes 15 minutes to compile from source and ain't nobody got time for that > softwareD # ostensibly available in nixpkgs, but the package is completely broken (more general case of 1password) Why not wrap the binaries yourself in flake.nix you say? Well, sure, would love to, if it wasn't such a pain in the ass to do so for each one and keep them up to date.

pxc 11mo ago
Brew-Nix might be able to cover some of those gaps, but probably not all of them. But almost certainly SoftwareC, at least! https://github.com/BatteredBunny/brew-nix https://github.com/BatteredBunny/brew-nix
- SOLAR_FIELDS 11mo ago
  What he is doing in there is kinda cool but the trampoline app solution is quite similar and unfortunately does not fix this problem. Fundamentally the problem is that when you install stuff with nix it gets a folder that is unique to that nix generation. That is by design nix, because you want to be able to go back and forth between generations etc. Apple does not think of things the same way. Applications is a single folder that you can’t subdivide with iterations and it’s “speshul”. These core philosophies are antithetical to each other. This is fine for Most applications who don’t need to be in Applications. You let Nix install into its own little /nix/ generation folder and then create a “trampoline” in applications which is basically like a symlink. Then your app shows up in spotlight etc. where this falls apart is applications like 1Password that MUST boot from the speshul Applications folder However, you are right, it definitely makes some other pieces of this cleaner. In particular, if you just use homebrew directly with nix, you aren't deterministic or reproducible. You have an impure setup because if you remove a cask from the list, it doesn't actually delete it from homebrew, and you can't go back and forth with generations because homebrew is stuffing things in /applications. The project you linked forces brew stuff to behave like Nix applications and go in /nix instead, which allows it to be able to walk between generations. So it solves most of the issues with brew and nix but not all of them.

ljm 11mo ago

Spack is a really unfortunate name for a project given that it's a slur derived from 'spastic' in the UK.

pxc 11mo ago
Can you just "pronounce" it (even in your head) S-pack, as in "source package"?