Homebrew Package Manager

repository·main·Indexed 13 days ago

https://github.com/homebrew/brew

A package manager for macOS and Linux that simplifies the installation and management of formulae (command-line tools) and casks (GUI applications). Includes documentation on the Homebrew Ruby API for creating formulae, environment configuration via brew.env and environment variables, and detailed acceptance policies for contributing to homebrew/core and homebrew/cask.

Tokens
150.6K
Snippets
552
Records
739
Agent score
100%

What's inside Homebrew

  1. Use Homebrew's MCP Server with AI assistants

    main

    Homebrew's MCP (Model Context Protocol) Server allows AI assistants (such as Cursor, VS Code, Claude Desktop, or Zed) to interact directly with Homebrew. It provides tools to execute Homebrew commands like brew search, brew install, brew uninstall, and brew upgrade. For developers contributing to Homebrew, it also exposes quality check commands like brew style, brew typecheck, and brew tests.

    No separate installation is required; the server is included with Homebrew and is accessed via the brew mcp-server command.

    $ brew mcp-server
    ==> Started Homebrew MCP server...
  2. Use the Homebrew Ruby API to create formulae

    main
    The Homebrew Ruby API is primarily used for creating Homebrew formulae (package descriptions). The central entry point for developers is the Formula class and its associated linked classes. When interacting with the codebase, assume that any class or method not explicitly part of the Formula ecosystem is private and intended for internal use only.
  3. Understand Homebrew's security and supply chain model

    main
    Homebrew's security model is designed to mitigate risks associated with the open-source software supply chain, such as maintainer account takeovers, self-propagating worms, typosquatting, and malicious install-time code. Unlike registries like npm or PyPI, which often allow for unilateral, instantaneous publishing with automatic code execution on install, Homebrew implements a trust model centered on human review, curated namespaces, and verified build artifacts.
  4. Access brew tab completions for bash, zsh, and fish

    main
    Homebrew provides tab completion scripts for bash, zsh, and fish shells. These scripts are located in subdirectories within the completions/ directory of the repository. Users can use these files to enable autocompletion for brew commands in their respective shell environments.
  5. Use install-time tokens in Cask stanzas

    main

    When defining steps that run during installation (like preflight_steps, postflight_steps, uninstall_preflight_steps, or uninstall_postflight_steps), do not use Ruby interpolation #{...} for values that depend on the installation environment. Instead, use {{...}} tokens. These tokens are expanded by the install-step runner at runtime.

    Commonly used tokens include:

    • {{token}}: The cask token (preferred over {{name}})
    • {{appdir}}: The directory of the application
    • {{caskroom_path}}: The path to the caskroom
    • {{staged_path}}: The path to the staged directory
    • {{version}}: The version of the cask
    • {{HOMEBREW_PREFIX}}, {{HOMEBREW_CELLAR}}, {{HOMEBREW_BREW_FILE}}
    • {{user}}, {{temp}}
    • {{version.major}}, {{version.major_minor}}
    write_file "settings.conf", "application = {{appdir}}/Example.app"
  6. Understand superenv and build isolation

    main

    superenv is Homebrew's "super environment" designed to isolate builds. It achieves this by:

    • Removing /usr/local/bin and non-essential user PATH entries to prevent environment pollution.
    • Removing problematic flags from clang/gcc commands.
    • Injecting necessary flags, such as adding keg_only dependencies to -I and -L flags.

    Note on Sandbox Errors: If you encounter Operation not permitted errors during a local build, it indicates the formula is attempting to write to a location outside its designated sandbox area. This is enforced on macOS via sandbox-exec.

  7. Use strategy blocks to manipulate version strings

    main

    If the upstream version format does not match the required formula/cask format, use a strategy block to transform the data. The arguments passed to the block depend on the strategy used.

    PageMatch strategy

    Used for scanning HTML content. The block receives |page, regex|.

    • Default: Extracts version via regex from the page.
    • Custom: Allows complex logic like combining multiple regex matches or reformatting strings.

    HeaderMatch strategy

    Used when version info is in HTTP headers (e.g., Content-Disposition or Location). The block receives |headers|.

    Git strategy

    Used for Git repositories. The block receives |tags| (an array of tag strings).

    GithubLatest and GithubReleases strategies

    Used for GitHub API interactions. The block receives |json, regex| (for GithubLatest) or |json| (for GithubReleases). You can inspect any field in the GitHub release JSON (e.g., tag_name, title, prerelease).

    Crate strategy

    Used for Rust crates. The block receives |json, regex| containing the registry API's versions data.

    # PageMatch example: combining two regex matches
    livecheck do
      url "https://example.org/my-app/download"
      regex(%r{href=.*?/(\d+)/MyApp-(\d+(?:\.\d+)*)\.zip}i)
      strategy :page_match do |page, regex|
        match = page.match(regex)
        next if match.blank?
        "#{match[2]},#{match[1]}"
      end
    end
    
    # HeaderMatch example: using multiple headers
    livecheck do
      url "https://example.org/my-app/download/latest"
      strategy :header_match do |headers|
        v = headers["content-disposition"][/MyApp-(\d+(?:\.\d+)*)\.zip/i, 1]
        id = headers["location"][%r{/(\d+)/download$}i, 1]
        next if v.blank? || id.blank?
        "#{v},#{id}"
      end
    end
  8. C++ runtime standards for macOS and Linux

    main

    The expected C++ runtime depends on the platform and toolchain:

    macOS

    • Apple Clang & Homebrew Bottles: Use libc++.
    • GNU GCC: Uses libstdc++.
    • Constraint: A formula built with GNU GCC must not pass C++ objects across a dependency boundary to a component built with an incompatible runtime (like libc++) unless upstream explicitly supports that combination.

    Linux

    • Homebrew Linux Toolchain: Normally uses libstdc++.
    • Constraint: A formula and the C++ libraries it consumes must agree on their runtime and ABI.
  9. Understand Cask artifact sandboxing and trust

    main

    Homebrew's security model for artifacts differs based on the stanza type:

    • Trusted Artifacts: app, pkg, and installer stanzas are treated as trusted vendor actions. They are expected to install software and may write outside the Caskroom (e.g., via macOS installer services or vendor code).
    • Sandboxed Artifacts: generate_completions_from_executable runs in an isolated Ruby subprocess sandbox. This sandbox allows reading the staged cask and writing completions/temporary files but blocks network access to limit side effects.
    • Unsandobxed Installers: installer scripts are not sandboxed. Because vendor installers often require sudo or broad filesystem access, macOS sandboxing cannot be applied to these root processes.
    • Unsandobxed Packages: pkg artifacts are installed by the macOS /usr/sbin/installer and are not run in the cask sandbox.
  10. Platform compatibility and macOS security for casks

    main

    Casks must be compatible with the operating systems and architectures they declare.

    Platform Rules:

    • Multi-OS Support: A cask can support macOS, Linux, or both, provided Homebrew supports those artifact types on those systems.
    • Architecture/OS Consistency: A cask must work on every declared operating system and architecture.
    • macOS Versioning: Casks must work on the latest major version of macOS.

    Security and Rosetta 2:

    • System Protections: Casks must not require disabling or bypassing System Integrity Protection (SIP) or Gatekeeper.
    • Rosetta 2 (Apple Silicon): Casks using the requires_rosetta caveat remain eligible while the latest major macOS release provides general Rosetta 2 support.
      • Under current Apple timelines, new requires_rosetta casks will become ineligible when macOS 27 is the latest stable version.
      • Existing requires_rosetta casks are expected to be deprecated during the macOS 27 lifecycle and removed after macOS 28 becomes the latest stable version.
  11. Understand what data Homebrew analytics collects

    main

    Homebrew collects aggregate, anonymous usage data to help maintainers prioritize packages and identify build failures. The data is stored in InfluxDB for 365 days.

    Privacy Protections:

    • The payload does not contain user identifiers or IP addresses.
    • Homebrew does not build individual user histories.
    • Build-error events do not include build logs or exception details.

    Collected Data Points:

    • Package/Cask Events: Package/tap names, install options, whether it was a direct request or a dependency, CI/developer mode status, CPU architecture, OS name/version, Homebrew version, and prefix type (custom-prefix or default).
    • Command Events: Command and option names (with option values removed). For common commands, one configuration variable name is randomly sampled to record if it was unset, default, or non-default (the value itself is not recorded).
    • CI/Test Data: BrewTestBot may send CI-only test-step results if enabled.