You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When uninstalling or upgrading certain casks with zap stanzas, I am prompted to input my password repeatedly for each privileged operation. This occurs even though I have granted "Full Disk Access" and "App Management" permissions to my terminal application (iTerm.app).
For example, when uninstalling the cleanmymac-zh cask, I am asked to input my password multiple times for various launchctl and file removal operations. Here's the output:
$ brew uninstall --cask cleanmymac-zh
==> Uninstalling Cask cleanmymac-zh
==> Removing launchctl service com.macpaw.zh.CleanMyMac4.Agent
Password:
==> Removing launchctl service com.macpaw.zh.CleanMyMac4.HealthMonitor
Password:
==> Removing launchctl service com.macpaw.zh.CleanMyMac4.Menu
Password:
==> Removing launchctl service com.macpaw.zh.CleanMyMac4.Scheduler
Password:
==> Removing launchctl service com.macpaw.zh.CleanMyMac4.Updater
Password:
==> Removing login item /Applications/CleanMyMac-X.app
==> Removing login item CleanMyMac 4 Menu
==> Removing files:
/Library/LaunchDaemons/com.macpaw.zh.CleanMyMac4.Agent.plist
Password:
/Library/PrivilegedHelperTools/com.macpaw.zh.CleanMyMac4.Agent
Password:
==> Backing App 'CleanMyMac-X.app' up to '/opt/homebrew/Caskroom/cleanmymac-zh/4.15.9/CleanMyMac-X.app'
==> Removing App '/Applications/CleanMyMac-X.app'
==> Purging files for version 4.15.9 of Cask cleanmymac-zh
This repeated password prompting makes the uninstall process inconvenient, especially for casks with numerous associated services and privileged files.
Steps to Reproduce
Install a cask with zap stanzas that include privileged files outside the ~/Library directory.
Run brew uninstall --cask <cask-name> or brew upgrade (if the cask upgrade triggers a zap operation).
Observe the repeated password prompts for each privileged operation.
Expected Behavior
Ideally, the password should be cached for the duration of the uninstall or upgrade operation, so users only have to enter it once.
Actual Behavior
The password is requested multiple times during a single uninstall or upgrade operation.
System Information
macOS Version: 15.2
Homebrew Version: Homebrew 4.4.13-11-g4ecf9b5
Terminal: iTerm.app
Permissions: "Full Disk Access" and "App Management" granted to iTerm.app
Additional Notes
I am using Homebrew on a company-managed computer, which might have additional security policies. However, other tools that require administrative access, like sudo, only request the password once per session.
Is there a recommended way to configure Homebrew to handle these operations more seamlessly? For example, could caching the password during a single operation be implemented or configured?
I believe this is an intentional change, potentially introduced here - Homebrew/brew#17694
Reusing sudo poses a security risk, as we want to ask for elevated privileges for each command, rather than running multiple commands with the elevation without explicit approval
This can be a bit frustrating, as someone who has recently been using a company managed laptop where the password needs to be input for all privileged operations. There are probably some optimizations we can make.
As some reference points -
Installing the Docker cask was 8 password prompts. Uninstalling was 11.
Installing the VMWare Fusion cask was 1 prompt. It fired all binary stanzas in one shot.
Using the binary ... target construct forces a password prompt each time (except shell completions fire in one shot). Docker may to be handled differently, could be because it's going to /usr/local on an Apple Siliconn machine (I need to continue looking, so let's take this as notes for now).
Applications (those using the app stanza, not pkg) generally require 7x password prompts per upgrade. Here's an example using Notion with some lines truncated for brevity.
When extrapolated out this can become a significant number of password prompts. Thankfully most of my apps are auto_updates true so it doesn't affect me too badly, but it means I don't send --greedy to keep the cache up to date.
Verification
--force
.brew update-reset && brew update
and retried my command.brew doctor
, fixed as many issues as possible and retried my command.Description of issue
When uninstalling or upgrading certain casks with
zap
stanzas, I am prompted to input my password repeatedly for each privileged operation. This occurs even though I have granted "Full Disk Access" and "App Management" permissions to my terminal application (iTerm.app
).For example, when uninstalling the
cleanmymac-zh
cask, I am asked to input my password multiple times for variouslaunchctl
and file removal operations. Here's the output:This repeated password prompting makes the uninstall process inconvenient, especially for casks with numerous associated services and privileged files.
Steps to Reproduce
zap
stanzas that include privileged files outside the~/Library
directory.brew uninstall --cask <cask-name>
orbrew upgrade
(if the cask upgrade triggers azap
operation).Expected Behavior
Ideally, the password should be cached for the duration of the uninstall or upgrade operation, so users only have to enter it once.
Actual Behavior
The password is requested multiple times during a single uninstall or upgrade operation.
System Information
iTerm.app
Additional Notes
sudo
, only request the password once per session.Thank you for your help in addressing this issue!
Command that failed
brew uninstall --cask
Output of command with
--verbose --debug
Output of
brew doctor
andbrew config
Output of
brew tap
The text was updated successfully, but these errors were encountered: