Opens profile photo
Follow
Homebrew
@MacHomebrew
Package manager for macOS (or Linux). Rude are blocked here and on GitHub (which means you can't file issues). Mastodon: @homebrew@fosstodon.org
brew.shJoined September 2009

Homebrew’s Tweets

We’ve been getting some questions about Max Howell’s (creator of Homebrew’s) new Tea project. Homebrew’s leadership or maintainers were not aware of this project until the announcement post. Homebrew and Tea are run, built, lead and funded separately to solve different problems.
3
183
A security researcher identified a vulnerability in the homebrew-cask* repositories' GitHub Actions. A cask was compromised with a harmless change in a demonstration PR until it was reverted. No user action is required. For more details read:
4
68
Homebrew taps (3rd-party repositories) now support a GitHub Actions-based workflow hosting their bottles (binary packages) on GitHub Releases (rather than Bintray). This should make it significantly easier to distribute macOS and/or Linux bottles.
85
Homebrew will be just fine without system ruby. Minor re-write of our installer, in order, but we have a "portable ruby" that we can use in a pinch! Also, please don't fret over /usr/local. Mahalo. 🌈🍻
Quote Tweet
I’ve seen people express concern that Apple’s Ruby announcement will affect Homebrew. Don’t worry - we’ve been shipping our own Ruby where needed for a few years now. We’re in a good position to adapt, and we’ll be ready long before the change actually happens.
5
149
Homebrew has had more unique contributions than any open source project ever. Thank you to everybody for every contribution, no matter the size. Special thanks to those that stepped up to be maintainers; a thankless task, a task that often came with abuse; they made brew possible
3
110
Show this thread
Here’s an excellent question asked by Homebrew user : How can you be sure you’re not going to catch a compromised formula or bottle, contributed by a malicious actor? A thread on ’s security.
Quote Tweet
For bottled @MacHomebrew formulas, how is it ensured that there aren't malicious code in the user generated submissions, notwithstanding SHA digest. @MikeMcQuaid
Show this thread
3
31
Show this thread
Note that VirusTotal does flag the nozlib version as malicious; however, that’s almost certainly a false positive: the same VT alert comes up for the (known clean) go-pear.phar from GitHub, too.
1
Show this thread