Skip to content

Allow uninstalling packages from untrusted taps without trusting the tap before ahdns. #22770

Description

@jeanthom

Verification

Provide a detailed description of the proposed feature

Make brew remove foobar (where foobar is a package from an untrusted tap) work.

What is the motivation for the feature?

I wanted to uninstall packages from some taps, but I ran into this:

$ brew -v
Homebrew 6.0.2-35-gfd99763
Homebrew/homebrew-core (git revision d240744b817; last commit 2026-03-27)
$ brew remove avr-gdb avr-gcc avr-binutils
Error: Refusing to load formula osx-cross/avr/avr-gcc@9 from untrusted tap osx-cross/avr.
Run `brew trust --formula osx-cross/avr/avr-gcc@9` or `brew trust osx-cross/avr` to trust it.

Trusting an untrusted tap to uninstall a package is a security liability.

How will the feature be relevant to at least 90% of Homebrew users?

I don't think it'll be relevant since most users don't use untrusted taps, and that's ok I guess?

What alternatives to the feature have been considered?

None.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions