XcodesOrg / XcodesOrg/xcodes

brew 5.1.15 warns about xcodes brew tab being untrusted, whilst trust check will be enforced in future homebrew 5.2 or 6.0 versions

Open
#478 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Swift
Stars
4.8k
Forks
182
Avg merge
2d 12h
Merged PRs (30d)
1

Description

I'd like to report the following warning from the homebrew package manager:

While updating packages on my mac, I got the following warning:

Warning: The following taps are not trusted:
  xcodesorg/made

Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.
Enable trust checks now with:
  export HOMEBREW_REQUIRE_TAP_TRUST=1
Trust specific formulae, casks or commands with:
  brew trust --formula <user>/<tap>/<formula>
  brew trust --cask <user>/<tap>/<cask>
  brew trust --command <user>/<tap>/<command>
or trust installed formulae from these taps with:
  brew trust --formula xcodesorg/made/xcodes
You can trust all formulae, casks and commands from these taps with:
  brew trust xcodesorg/made
Prefer trusting only the specific formulae, casks or commands you need.
Untap them with:
  brew untap xcodesorg/made
To keep allowing them by default during the transition:
  export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.

To confirm, here's the output of brew untrust on my machine:

Untrusted taps:
  xcodesorg/made
Untrusted formulae:
  xcodesorg/made/xcodes

In following versions, it will be required to instruct users to manually trust the formula/cask/tap when installing packages from unofficial homebrew taps according to this documentation.

I do not think there's any mechanism the XcodesOrg team can use to make the xcodes formula be "trusted by default", but I may be wrong about that.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The payload names no project file, test, or entry point. Start with the linked Tap Trust documentation and investigate how the xcodesorg/made tap is distributed; the issue needs a concrete decision about whether to change project behavior or document the required trust step before implementation can be considered done.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, shell
Domain
cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.