Homebrew macOS cask is being disabled due to Apple Gatekeeper failure

[AlexanderTheGrey]

Homebrew is disabling the Sioyek cask on September 1, 2026 because the macOS build fails Gatekeeper checks:

Homebrew/homebrew-cask#256265

https://formulae.brew.sh/cask/sioyek

Would it be possible to sign and notarize the macOS releases so the cask can remain available in Homebrew?

If that isn't practical, particularly because it requires a paid Apple Developer Program membership, could Sioyek maintain its own Homebrew cask tap instead? Homebrew supports third-party taps containing casks, so this would preserve Homebrew installation without requiring the app to meet the official homebrew/cask Gatekeeper policy.

The existing unsigned releases could also continue to be distributed directly, since macOS still allows users to explicitly approve an unsigned app through Privacy & Security -> Open Anyway. Nix/Nixpkgs is another existing distribution option that does not depend on the official Homebrew cask.

It looks like Homebrew is now requiring official casks to pass Gatekeeper rather than allowing the previous workaround for unsigned apps.

[ahrm]

I don't maintain the homebrew cask, you should contact the maintainer for that, or find a new maintainer who is willing to do it. Apple development program membership is not a possibility for me.

[AlexanderTheGrey]

I think there may be a misunderstanding about how Homebrew Casks work. Homebrew is not building Sioyek itself. The cask simply downloads the macOS artifact from Sioyek's GitHub release and installs sioyek.app.

The current cask points directly to:

https://github.com/ahrm/sioyek/releases/download/v#{version}/sioyek-release-mac.zip

So the Gatekeeper issue is with the upstream macOS release artifact itself. If signing/notarization isn't practical, maintaining the same cask in a Sioyek-owned third-party Homebrew tap should avoid the new homebrew/cask policy while continuing to use the existing release artifacts.

[ahrm]

maintaining the same cask in a Sioyek-owned third-party Homebrew tap should avoid the new homebrew/cask policy

What does that mean? I am not very familiar with homebrew.

[AlexanderTheGrey]

A Homebrew tap is just a separate Homebrew repository that you control. For example, you could create:

ahrm/homebrew-sioyek

Homebrew maps repositories named homebrew-<name> to taps, so that repo becomes:

ahrm/sioyek

Users could either add the tap explicitly:

brew tap ahrm/sioyek
brew install --cask sioyek

or install directly in one command:

brew install --cask ahrm/sioyek/sioyek

The final sioyek is the cask name inside the tap. The cask could keep using the same GitHub release artifacts as the current official cask, without being subject to the official homebrew/cask Gatekeeper policy.

[ahrm]

I just don't understand the difference between the current homebrew cask and the one that I will be making. Is it just because I am the author of this repo that the cask is not subject to the same requirements as the current cask?

[AlexanderTheGrey]

No. It has nothing to do with you being the author.

The current cask is in Homebrew's official homebrew/cask repository, so it has to follow Homebrew's rules, including the new Gatekeeper requirement.

A cask in your own tap is a third-party cask. Homebrew does not maintain or review third-party taps under those same acceptance rules. It can still point to the exact same Sioyek release file. The only real change is where the cask definition lives.

[AlexanderTheGrey]

Also, the workaround already documented in Sioyek's README/discussion is to remove the quarantine attribute with xattr:

#1156 (reply in thread)

Your tap could automate the same workaround in the cask's postflight step:

postflight do
  system_command "/usr/bin/xattr",
    args: ["-dr", "com.apple.quarantine", "#{appdir}/sioyek.app"]
end

That should prevent users from having to manually allow Sioyek in macOS settings.

[maxinchun5]

A Homebrew tap is just a separate Homebrew repository that you control. For example, you could create:

ahrm/homebrew-sioyek

Homebrew maps repositories named homebrew-<name> to taps, so that repo becomes:

ahrm/sioyek

Users could either add the tap explicitly:

brew tap ahrm/sioyek brew install --cask sioyek

or install directly in one command:

brew install --cask ahrm/sioyek/sioyek

The final sioyek is the cask name inside the tap. The cask could keep using the same GitHub release artifacts as the current official cask, without being subject to the official homebrew/cask Gatekeeper policy.

@AlexanderTheGrey
I‘ve moved all casks that are disabled due to gatekeeper check into this tap maxinchun5/community-cask.
You guys can download sioyek from this tap directly:

brew tap maxinchun5/community-cask
brew trust maxinchun5/community-cask
brew install --cask maxinchun5/community-cask/sioyek

This tap has CI to maintain subsequent updates automatically.