Homebrew 6.0 Just Changed How Your Mac Installs Software
BBetter Stack
Computing/SoftwareInternet Technology
Transcript
00:00:00A few months ago on this very channel, we made a whole video that basically called Homebrew
00:00:05this Stone Age thing we use because Nix runs circles around it. So it's only fair that I
00:00:12circle back here and tell you this. The Stone Age thing that we were using just shipped its first
00:00:17major version in years, Homebrew 6.0. And here's the big thing. The headlines isn't a pile of new
00:00:23features. It's a complete security overhaul. Homebrew just grew up.
00:00:30Now, let me explain what actually changed because it's more interesting than just a bumped version
00:00:38number. For basically the entire life of Homebrew, when you added a third-party tap, someone else's
00:00:45package repo, Homebrew would just run their Ruby code. It would just execute their code. Any tap,
00:00:51arbitrary code, without really any questions asked. Now, think about that world that we're in now.
00:00:56Package managers are the number one target for supply chain attacks right now. NPM, all of them
00:01:01getting hit over and over. We'll just run whatever code the repo hands us is a bad default. And Homebrew
00:01:086.0's feature exists to kill that. It's called Tap Trust. If you enjoy coding tips and tricks like this,
00:01:15be sure to subscribe. We have videos coming out all the time. But let me start with the part you'll
00:01:19actually feel every single day. Brew version. There it is. 6.0. Now, watch what happens when I install
00:01:25something that pulls a few dependencies. Instead of silently going off and doing it, Brew now lays
00:01:31out a summary of everything it's about to install and waits for me to say yes. That's the new Ask mode,
00:01:38and it's on by default for devs now. Tiny change, but it means you always see the plan before Brew lays
00:01:44a finger on any of our machine. Now the big one, Tap Trust. Watch when I add a third-party tap.
00:01:50Homebrew stops me cold. It says this tap isn't trusted yet, and it will not run a line of its code
00:01:56until I explicitly say so. I trust it on purpose with Brew Trust, and only then does it actually
00:02:03execute. The official homebrew taps, trusted right out of the box. So your normal Brew install life
00:02:09is the exact same. But that little sketchy tap from some GitHub stranger that you found on a readme,
00:02:16now that's kind of like a locked door. You have to actually approve that. And honestly,
00:02:20that's probably a pretty good decision at this point. And this isn't the only real upgrade here.
00:02:25The internal metadata system is now the default, which means all your package info comes down in one
00:02:30clean download instead of a dozen little network trips. So Brew update is a lot quicker. There's a
00:02:37brand new command, Brew execute, which basically is MPX for homebrew. Run a tool once without permanently
00:02:45bolting it onto your system. There's Brew vulns, which scans packages you already have installed against
00:02:51known security issues, advisories. And 6.0 quietly patched three security holes, including one that could run
00:02:58code as root through the Mac installer package. This is a release with the spine. Okay. Now here's the
00:03:04catch with all this. And for some of you, it's going to be a big one. So I'm just going to bury it on you.
00:03:09Tap trust is the breaking change. If you've got CI pipelines that lean on third-party taps,
00:03:14Brew doctor now throws an air the moment it sees an untrusted one. And a huge number of standard GitHub
00:03:20actions run Brew doctor as their very first step. So people upgraded and their build just started failing.
00:03:28The fix is to mark those taps as trusted in your config, but you have to actually go do it yourself.
00:03:35Nobody's going to do it for you. Same story with the ask mode. If you've got scripts that quietly assumed
00:03:41Brew installs without asking, that new prompt can leave them hanging forever. Now the whole framing thing
00:03:46too, if you're just a regular person installing apps day to day, this barely looks any different.
00:03:51This is a security and architecture release, not just a fresh coat of paint. One quick myth here too.
00:03:58A lot of things are getting rewritten in Rust. No, homebrew is not getting rewritten in Rust,
00:04:04at least not now. That was a whole experiment. The focus is right back on the Ruby code base as it
00:04:10always was. So should you upgrade to homebrew 6.0 for almost everyone? The answer is just yes.
00:04:16You're getting three security fixes and frankly, brew update is going to walk you on to 6.0,
00:04:22whether you plan for it or not. Now the people who maybe need to slow down a little bit here is
00:04:27anyone running CI that touches third party taps or automation that expects silent installs. Handle those
00:04:33first, you're golden. And if you're still on an Intel Mac, heads up. 6.0 spells out the timeline for
00:04:40retiring Intel support over the next couple of years. Apple Silicon people, the new computers,
00:04:46we're completely fine. It even adds support for the new M5 chips. Here's how I'd kind of leave this.
00:04:53For years, homebrew was a convenience to say the least, just the fastest way to get software onto a
00:04:59Mac. With 6.0, it looks like it's turned itself into more of a checkpoint, a place where the code
00:05:05coming onto the machine finally has to prove it's trusted. This is a big step. The package manager
00:05:10caught up to the threat model the rest of us have been living inside for years. That's the real thing
00:05:15here. Not the number in the box, 6.0, 6.1. It's what came with it. If you enjoy coding tips and tricks
00:05:21like this, be sure to subscribe to the BetterStack channel. We'll see you in another video.