Homebrew: Cask Security Gets Simpler and Safer
Mike McQuaid landed two related changes that make cask quarantine handling both more secure and less dependent on developer tooling, while smaller fixes address bottle URLs, license metadata, and command typos.
Duration: PT2M29S
Episode overview
This episode is a short developer briefing from Homebrew.
It explains recent repository work in plain language.
- Show: Homebrew
- Published: 2026-07-12T13:09:48Z
- Audio duration: PT2M29S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
It's July 12, 2026, and this is Homebrew's daily developer briefing.
The top story today is a coordinated cleanup of how casks handle macOS quarantine and Gatekeeper approval. Two PRs from Mike McQuaid work together here. PR 23060 changes how Homebrew preserves quarantine approval when upgrading a cask app — instead of triggering repeated Gatekeeper prompts, it now checks whether the…
The companion change, PR 23061, removes the developer-only rollout gates for cask FFI helpers — quarantine handling, extended attribute copying, and Trash operations — making them available to all users, not just those with Swift and developer tools installed. Together, these two PRs mean quarantine and Gatekeeper…
Second theme: metadata correctness. PR 23063 from hyuraku fixes how GitHub Packages handles long license strings — previously, any license over 256 characters got discarded entirely and replaced with a generic "cannot represent" tag. Now it truncates and keeps as much real license data as fits, which matters for…
Two smaller items worth flagging. PR 23062 from jouve is under review with a change request — it repositions artifact domain paths in bottle URLs, so expect revisions before merge.…
Wh…
Nearby episodes from Homebrew
- Cask Installs Get Faster and More Permissive
- Cask Installs Get Faster and Safer
- Cleaning Up the Test Sandbox and Upgrade Edge Cases
- Cask Upgrades Get an Integrity Pass
- Performance Sweep and Cask Upgrade Fixes
- Metadata Moves to JSON, and the Ruby Bridge Narrows
- Weekly Recap - Cask Metadata Goes JSON, and Performance Gets Serious
- Locking Down Casks and Network Trust