Why casks gets deprecated because of gatekeeper check (unsigned)?

[l4zygreed]

Output of brew config

HOMEBREW_VERSION: 4.6.17-63-g085edfc
ORIGIN: https://github.com/Homebrew/brew
HEAD: 085edfc8bb2ea5783586ae71e6c4bdb7c26fcd40
Last commit: 11 hours ago
Branch: main
Core tap JSON: 20 Oct 01:44 UTC
Core cask tap JSON: 20 Oct 01:44 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: nvim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 10
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.5/bin/ruby
CPU: deca-core 64-bit arm_firestorm_icestorm
Clang: 17.0.0 build 1700
Git: 2.51.1 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.0.1-arm64
CLT: 26.0.0.0.1.1757719676
Xcode: 26.0
Rosetta 2: false

Output of brew doctor

...
Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  alacritty
  qutebrowser
....

Description of issue

In last 2 months homebrew-core repo deprecated an impressive amount of cask applications. And that list slowly gets updated. The reason is:

Deprecated because it does not pass the macOS Gatekeeper check! It will be disabled on 2026-09-01.

Which means that applications will be removed because they don't signed with apple certificate.

So what will happen? Homebrew will deprecate and remove ~95% of casks because mostly all developers don't want to pay yearly subscription to apple? And we'll return to install software from .dmg days or use unofficial tap?

I don't know what happens with homebrew, but removed conflicts_with without replacement and now this makes me worried. And unfortunately there is no replacement for homebrew with such big list of apps in it.

Relevant casks

alacritty, qutebrowser

[SMillerDev]

So what will happen? Homebrew will deprecate and remove ~95% of casks because mostly all developers don't want to pay yearly subscription to apple? And we'll return to install software from .dmg days or use unofficial tap?

Out of 7624 casks, 387 are deprecated because they fail gatekeeper checks. That's 5 percent, so it seems you got very little to worry about.

I don't know what happens with homebrew, but removed conflicts_with without replacement and now this makes me worried. And unfortunately there is no replacement for homebrew with such big list of apps in it.

conflicts_with was never implemented so the only thing that was removed was the ability to add useless code to a cask. If you want a replacement, feel free to make a pull request.

[SoftwareRat]

The user experience for unsigned software is a dumpster fire

The user experience of being able to install programs that no mega-corporation has approved? Sounds more like a post-hoc attempt at justification.

You're free to maintain your own tap that installs whatever you want, that doesn't mean homebrew has to.

How about you just don't deprecate it and the discussion is over. The effort would be significantly lower. Instead of me having to reinvent the wheels, you can just... well... not burn the wheels?

[newearthmartin]

The user experience for unsigned software is a dumpster fire

All the unsigned softwares that I use are perfectly fine and I've been using them for years

keeping it out of the main taps of homebrew means less people are subjected to that dumpster fire

You are treating users like children. Users who can use the terminal for installing software are perfectly capable of assessing risk and use an --allow-unsigned flag if they decide.

[bevanjkay]

Nobody is preventing you from installing these software with Homebrew, we just won't be hosting them in the homebrew/cask tap anymore, as they have not met the requirements for inclusion for some time now. You can add them to your own tap.

[cootshk]

Nobody is preventing you from installing these software with Homebrew, we just won't be hosting them in the homebrew/cask tap anymore, as they have not met the requirements for inclusion for some time now. You can add them to your own tap.

Considering that they're already in the official tap, wouldn't it just be easier to have a second optional tap of homebrew/unsigned-cask?

[SMillerDev]

That doubles the work that maintainers would have to volunteer. That's not a sustainable option. But you can run that tap with the others in this thread who want it.

[newearthmartin]

Give power to users, not to corporations.

Make an option to install unsigned anyways. You don't need to remove these packages, just mark them as unsigned.

[p-linnane]

Anyone can create their own Tap and add whatever they'd like to it. By default, we don't even check signing status on third-party taps.

[newearthmartin]

Why wouldn't you check signing status on third-party taps if you thought it was so important?
It seems there is an incentive to keep unsigned packages out of the official taps that's not quite transparent. Is Apple forcing you to do this? Of course you wouldn't tell me if it was the case

[bevanjkay]

Third-party taps get to choose whatever audits they wish to apply, and many don't use brew audit at all.
The incentive is that the user experience is sub-optimal, software installed from an official tap should just work, otherwise users are inclined to submit bug reports for things that are outside of Homebrew's control.

I get the impression from your tone that continuing this discussion is fruitless. I hope that you find a packaging solution that works for you, but being accusatory here isn't going to change anything.

[newearthmartin]

I'm in this tone because we are being told something is for "my safety" when it only follows along the path of more control for Apple over my own computer. I don't see any relationship between unsigned status and bug reports, or any reason why an open source project should be paying Apple to sign their software. "Safety" is usually the path that your freedom is taken away.

And this is not going to improve my user experience, in fact it's going to make it worse because I will have to find replacements for software that I can easily install with brew, or find taps that have them or create taps myself.

[p-linnane]

I'm going to add one final response before I lock this thread.

Apple has no say over how we do anything in Homebrew. We, the unpaid volunteer maintainers of Homebrew, have decided we don't want to support unsigned/notarized software in the main Homebrew/cask tap anymore. This doesn't stop anyone from maintaining their own tap full of unsigned software. I maintain a personal tap with unsigned software myself.

The decision has been made, and the it's up to the community to create taps that are meaningful for them if software isn't allowed in Homebrew/cask.