Deprecation of --no-quarantine flag

[vcekron]

Output of brew config

❯ brew config
HOMEBREW_VERSION: 5.0.0
ORIGIN: https://github.com/Homebrew/brew
HEAD: c9ab4622bce3bc96253c66d2e775cedf92ad40a8
Last commit: 2 hours ago
Branch: main
Core tap JSON: 12 Nov 10:25 UTC
Core cask tap JSON: 12 Nov 10:25 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_ASK: set
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 28
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 14
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.5/bin/ruby
CPU: 14-core 64-bit arm_brava
Clang: 17.0.0 build 1700
Git: 2.50.1 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.1-arm64
CLT: 26.1.0.0.1.1761104275
Xcode: N/A
Rosetta 2: false

Output of brew doctor

❯ brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  darktable
  xld

Description of issue

First of all, let me just say that I respect your right to remove casks without codesigning from Homebrew/homebrew-cask. I don't necessarily agree with this decision, but, at the end of the day, that's your tap, and you decide what is and isn't allowed on there.

My question is about your response in discussion #6482 where @bevanjkay said

Nobody is preventing you from installing these software with Homebrew, we just won't be hosting them in the homebrew/cask tap anymore, as they have not met the requirements for inclusion for some time now. You can add them to your own tap.

Specifically, I wonder how this relates to PR #20929, where you removed support for the --no-quarantine flag. Does this mean that there is now no supported method of installing unsigned software even from your own tap without doing post-processing to the tune of sudo xattr -rd com.apple.quarantine /path/to/Application.app to be able to launch the application?

Looking forward to your response, thanks! It's entirely possible I'm just missing something here.

[bevanjkay]

Yes, post-processing is required, as it would be if you download and extract the files using other methods.

[vcekron]

From my point of view, this seems quite unnecessary when you're already blocking all such casks from the main Homebrew tap. Isn't that enough to shield the average user from the "dumpster fire" of unsigned software, as @SMillerDev put it in #6482?

[p-linnane]

You can read this great explanation from @gromgit in my issue where we announced this change: Homebrew/brew#20755 (comment).

[vcekron]

Thanks for the link, @p-linnane. This added context does indeed provide some important nuance to the topic. It will be interesting to see how this change will affect users going forward and whether or not there will be a joint effort by community members to provide a tap of unsigned software with xattr in the cask files now that they're no longer welcome in the official tap.

I'm personally not too affected by these changes since I only use a couple of unsigned casks at the moment, but the development caught me off guard. I very much appreciate your willingness to engage with the topic, though, and I now see the rationale behind your decision a lot better with the added context you provided.

[Soromeister]

You can just run sudo xattr -rd com.apple.quarantine /Applications/* after brew install or brew update/upgrade to do the same thing.

[bennett-elder]

Important detail here since that change was enacted with Homebrew 5.1, not in September as was implied by previous discussion about unsigned casks.

[SMillerDev]

Even more important detail is that the command makes your device trust everything in your applications folder without any reservations. So you should only run it if you fully trust every download of every program in the folder

[bennett-elder]

yeah I'd want to run it with the app filename instead of a wildcard.