Upgrading Homebrew and avoiding the failed to verify attestation error

I managed to get my Homebrew installation back into shape today. The first problem I was having is that it complained that macOS Sequoia was unsupported:

Warning: You are using macOS 15.
We do not provide support for this pre-release version.

It turns out I was on an older Homebrew version. Sequoia support was added in Homebrew 4.4.0 released on October 1st 2024.

For some reason brew update wasn't fetching that new version. I ended up using this recipe from StackOverflow:

cd "$(brew --repo)" && git fetch && git reset --hard origin/master && brew update

After publishing this I got this tip from Homebrew team member @yossarian:

you’re getting attestations by default probably because you have developer mode enabled; those kind of rate limiting issues are why it isn’t in GA yet

I must have turned developer mode on years ago and forgot about it! Here's the documentation, which also explains why my brew update command didn't work as expected:

When developer mode is enabled, brew update will update Homebrew to the latest commit on the master branch instead of the latest stable version along with some other behaviour changes

To check the mode run:

brew developer

I got this:

Developer mode is enabled.

To turn it off:

brew developer off

Then confirm:

brew developer

Developer mode is disabled.

I believe the challenges I had in this TIL can be explained by developer mode.

Homebrew added a feature recently that checks cryptographical "attestations" on downloaded packages. This is implemented via the GitHub gh command.

My first problem was that I got this error:

unknown command "attestation" for "gh"

The solution (thanks again, StackOverflow) was to manually upgrade the gh package first to get the new command:

brew upgrade gh

Then I ran brew upgrade to upgrade everything... which didn't quite work, because I kept running into warnings like this one:

==> Verifying attestation for ca-certificates
Warning: Failed to verify attestation. Retrying in 1...
Warning: Failed to verify attestation. Retrying in 3...
Warning: Failed to verify attestation. Retrying in 9...
Warning: Failed to verify attestation. Retrying in 27...

I frequently have rate limiting problems with my GitHub account, so my hunch is that these were causing the command to fail.

The fix was to run this instead, using the HOMEBREW_NO_VERIFY_ATTESTATIONS environment variable to disable attestation checking entirely:

HOMEBREW_NO_VERIFY_ATTESTATIONS=1 brew upgrade

Created 2024-10-09T08:09:34-07:00, updated 2024-10-09T09:58:33-07:00 · History · Edit