Homebrew 6.0.0: Securing Third-Party Formulae with Tap Trust
For years, installing a third-party tap in Homebrew was essentially a leap of faith. You were trusting that the maintainer wasn't hiding a malicious Ruby script in their repository, because once you added that tap, Homebrew would happily execute that code on your machine. It's a massive security blind spot that's always felt a bit reckless, especially for anyone managing a production environment. The latest update finally fixes this with a new tap trust mechanism. Now, Homebrew won't just blindly evaluate code from an untrusted tap. It flags them first and requires you to explicitly trust the source before anything runs. It's a sensible change, and honestly, it's overdue. There is plenty of other stuff in this release, like sandboxing on Linux and initial support for macOS 15. But the real story is how Homebrew is finally tightening the screws on how it handles external code. I'm curious if this will actually change how people manage their taps, or ...