Starting about a week ago, the Homebrew section in the ujust update command began giving me an occasional (every couple of days) warning about untrusted taps:
── 19:50:47 - Brew ─────────────────────────────────────────────────────────────
==> Updating Homebrew…
Already up-to-date.
Warning: The following taps are not trusted:
valkyrie00/bbrew
Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.
Enable trust checks now with:
export HOMEBREW_REQUIRE_TAP_TRUST=1
Trust specific formulae, casks or commands with:
brew trust --formula //
brew trust --cask //
brew trust --command //
or trust installed formulae from these taps with:
brew trust --formula valkyrie00/bbrew/bbrew
You can trust all formulae, casks and commands from these taps with:
brew trust valkyrie00/bbrew
Prefer trusting only the specific formulae, casks or commands you need.
Untap them with:
brew untap valkyrie00/bbrew
To keep allowing them by default during the transition:
export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.
So far, that warning has been just on valkyrie00/bbrew. The first time I got that warning, I followed the instructions to enable trust checks with:
export HOMEBREW_REQUIRE_TAP_TRUST=1
Since I’m still getting the warning on whatever that valkyrie00/bbrew thing is, I also tried following the instructions to untap it with:
brew untap valkyrie00/bbrew
But that just gives me an error:
Error: Refusing to untap valkyrie00/bbrew because it contains the following installed formulae or casks: bbrew
EDIT: From what I can find, I’m pretty sure bbrew (Bold Brew) is pre-installed on Universal Blue distributions (since I didn’t install it (AFAIK)) and valkyrie00 is the developer. So, this ought to be trusted.
Trust specific formulae, casks or commands with: brew trust --formula // brew trust --cask // brew trust --command // or trust installed formulae from these taps with: brew trust --formula valkyrie00/bbrew/bbrew You can trust all formulae, casks and commands from these taps with: brew trust valkyrie00/bbrew
I hate displaying my ignorance, but I don’t know how to properly trust this. Those instructions talk about trusting specific formulas, casks, commands, installed formulae, all formulae, casks and commands. But, I’m entirely unfamiliar with that jargon and don’t know which I should do. I’m guessing the last option:
Had a similar warning come up, after using ujust clean-system command in terminal it went away and has not come back. Worth a try at least, if the warning is annoying.
The problem is that I don’t know anything about bbrew or how it works. I don’t understand the jargon in all the trust methods it offers. Granting trust to something I don’t understand with methods I don’t understand and hoping for a miracle is not something I really want to do.
Looking at:
it looks like I should be as specific as possible. According to that document, brew trust user/repo trusts the whole tap. But, then it says:
Whole-tap trust is broader. It allows Homebrew to load every current and future formula, cask and external command from that tap. This may be appropriate for a tap you administer or rely on heavily, but for one-off installs, automation or software from a vendor you do not fully control, prefer trusting only the item you need.
So, it sounds like I don’t want that.
Running brew doctor in Konsole gives more information. But, in this case, the gist is the same:
Warning: The following taps are not trusted: valkyrie00/bbrew Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Trust specific formulae, casks or commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> or trust installed formulae from these taps with: brew trust --formula valkyrie00/bbrew/bbrew You can trust all formulae, casks and commands from these taps with: brew trust valkyrie00/bbrew Prefer trusting only the specific formulae, casks or commands you need. Untap them with: brew untap valkyrie00/bbrew To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release.
But, I’m still at a loss as to trusting any/some/all of formulas, casks, and/or commands for valkyrie00/bbrew and I don’t want to guess regarding trust and the functionality of the thing.
Probably a silly thing for me to do, but I’ve also kicked the can upstairs a bit:
With the rise of supply chain attacks lately, it is good to be cautious and ask a lot of questions to learn what the risks are. It really comes down to trust and what safeguards are in place in the system. Not sure that homebrew is any better than other package management tools.
The developer of bbrew responded to that issue I opened (see above):
"…thank you so much for opening this. Yes, you’re probably right, to get this “trusted,” it’s very likely that I’ll have to request official integration into the official Homebrew repository. I know there are some minimum requirements to propose an integration, so I’ll need to look into it a bit and update you soon.
The developer has merged bbrew into hombrew/core. Here’s from that issue I posted:
Hey Folks, great news!
As of today, bbrew has been merged into homebrew-core (Homebrew/homebrew-core#291114), which means it’s now a first-party trusted formula.
To fix this on your end:
# Remove the untrusted custom tap
brew untap valkyrie00/bbrew
# Install directly from homebrew-core (trusted by default)
brew install bbrew
No more trust warnings, no --force flags needed. The formula is now maintained in the official Homebrew repository and will receive bottles (pre-built binaries) for all supported platforms.
I’ll start a thread on the Bluefin discussion channel to let them know that it’s no longer necessary to handle the tap.
Thanks again for reporting this, it was actually one of the motivations to push for the homebrew-core inclusion!
EDIT: I’m not sure this is working yet. Untapping doesn’t seem to work:
brew untap valkyrie00/bbrew
Error: Refusing to untap valkyrie00/bbrew because it contains the following installed formulae or casks:
bbrew
I don’t think uninstalling valkyrie00/bbrew worked either: brew uninstall valkyrie00/bbrew ==> Autoremoving 3 unneeded formulae: libevent libnghttp2 unbound Uninstalling /home/linuxbrew/.linuxbrew/Cellar/unbound/1.25.1... (60 files, 11.3MB) Warning: The following unbound configuration files have not been removed! If desired, remove them manually with `rm -rf`: /home/linuxbrew/.linuxbrew/etc/unbound /home/linuxbrew/.linuxbrew/etc/unbound/unbound.conf /home/linuxbrew/.linuxbrew/etc/unbound/unbound.conf.default Uninstalling /home/linuxbrew/.linuxbrew/Cellar/libevent/2.1.13... (63 files, 2.7MB) Uninstalling /home/linuxbrew/.linuxbrew/Cellar/libnghttp2/1.69.0... (15 files, 952KB) Error: No available formula with the name "bbrew". Did you mean bbe?
brew list showed plain old bbrew installed. Trying to install it (again) gives:
brew install bbrew ✔︎ JSON API packages.x86_64_linux.jws.json Downloaded 15.2MB/ 15.2MB Error: bbrew was installed from the valkyrie00/bbrew tap but you are trying to install it from the homebrew/core tap. Formulae with the same name from different taps cannot be installed at the same time. To install this version, you must first uninstall the existing formula: brew uninstall bbrew Then you can install the desired version: brew install bbrew
brew uninstall bbrew seems to have worked. But, then trying to install the plain old bbrew might have worked, but gives me odd messages:
brew install bbrew Warning: The following taps are not trusted: valkyrie00/bbrew Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Untap them with: brew untap valkyrie00/bbrew Trust specific formulae, casks and commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> Whole-tap trust is broader and includes all current and future formulae, casks and commands from the listed taps. Trust whole taps with: brew trust valkyrie00/bbrew To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release. For more information, see: https://docs.brew.sh/Tap-Trust`==> **Would install 1 formula:**bbrew ==> **Downloading https://ghcr.io/v2/homebrew/core/bbrew/manifests/2.3.0`**` ` `#################################################################################################################################### 100.0% ` `==> `**`Fetching downloads for: bbrew`**` ` `✔︎ Bottle bbrew (2.3.0) Downloaded 3.4MB/ 3.4MB ` `==> `**`Pouring bbrew--2.3.0.x86_64_linux.bottle.tar.gz`**` ` `🍺 /home/linuxbrew/.linuxbrew/Cellar/bbrew/2.3.0: 6 files, 8.5MB ` `==> `** Running brew cleanup bbrew… **` ` Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP=1. Hide these hints with HOMEBREW_NO_ENV_HINTS=1 (see man brew). `` Removing: /home/dave/.cache/Homebrew/bbrew--2.2.1.tar.gz... (3.3MB)
The command bbrew does work though without any kind of security warning. So, I’m not sure what I’ve done.
EDIT 2: And, after a reboot, ujust update still gives:
Warning: The following taps are not trusted: valkyrie00/bbrew
So, the non-core version might be uninstallable for us. Perhaps it’s considered part of the OS and we’ll have to wait for Bazzite to make the switch?
EDIT 3: I’m not sure if it’s necessary, but operating on the above assumption that the Bazzite team will have to change bbrew at the OS level, I opened an issue there (I figure it can’t hurt):
Hombrew core updated this morning with a ujust update. Untapping valkyrie00/bbrew and installing plain old bbrew worked after that. I closed that issue I opened.
"