Tap Trust

Homebrew taps can contain formulae, casks and external commands. Loading them can run Ruby code from the tap, so Homebrew distinguishes between official taps and non-official taps that you have explicitly trusted.

Official Homebrew taps and Homebrew's built-in commands are always trusted. Non-official taps require explicit trust by default since Homebrew 6.0.0.

brew doctor warns about non-official taps for which neither the tap nor any individual item is trusted. Commands that need to load an untrusted tap or item will fail until the relevant trust is granted.

Why tap trust exists

Formulae, casks and external commands are executable package definitions, not plain metadata. Homebrew sometimes needs to evaluate Ruby code from a tap to resolve dependencies, discover packages or run commands. Trusting a tap means accepting that its code may run with your user's privileges whenever Homebrew loads it.

Tap trust reduces the amount of non-official code Homebrew evaluates by default. This limits the impact of compromised tap repositories, unexpected repository ownership changes, package name collisions and commands loaded merely because their tap is present. It also makes automation explicit by allowing scripts to trust only the tap, formula, cask or command they intend to use.

Tap trust is one part of Homebrew's wider approach to software supply chain security.

Prefer trusting the specific formula, cask or command you need. Trust a whole tap only when you accept all current and future formulae, casks and external commands from that tap.

Installing from a tap

Installing a fully qualified formula or cask name trusts only that item:

brew install user/repository/formula
brew install --cask user/repository/cask

To install by short name from a tapped repository, trust the specific item first:

brew tap user/repository
brew trust --formula user/repository/formula
brew install formula

Use brew trust --cask user/repository/cask for casks and brew trust --command user/repository/command for external commands.

You can also trust the whole tap:

brew tap user/repository
brew trust user/repository
brew install formula

Whole-tap trust allows Homebrew to load every current and future formula, cask and external command from that tap. This may be appropriate for a tap you administer or use frequently. For one-off installs, automation or software from a vendor you do not fully control, prefer trusting only the required item.

Trusting in a Brewfile

For Brewfile trust syntax and brew bundle dump and cleanup behaviour, see the trusted section of the Homebrew Bundle documentation.

Managing trust

List trusted entries:

brew trust

List untrusted taps, formulae, casks and commands:

brew untrust

Stop trusting a tap or item:

brew untrust user/repository
brew untrust --formula user/repository/formula

An untrusted tap is not loaded when tap trust is required unless you explicitly install a fully qualified formula or cask from that tap. If you trust only a specific formula, cask or command, Homebrew may load that item without trusting the rest of its tap.

Environment variables

Tap trust is required by default. The default trust configuration also enables commands that evaluate all formulae or casks. HOMEBREW_REQUIRE_TAP_TRUST=1 explicitly retains that behaviour.

HOMEBREW_NO_REQUIRE_TAP_TRUST=1 disables the default trust requirement. Disabling tap trust allows Homebrew to load code from every tapped repository and is not recommended. Commands that evaluate all formulae or casks remain enabled when this opt-out is set. This temporary opt-out will be removed in a later release.