chromedriver OS privileges problem?

[jrochkind]

On MacOS 12.3.1 (Monterey), if I do a brew install chromedriver and then run something that tries to use chromedriver, I get a MacOS error alert:

“chromedriver” can’t be opened because Apple cannot check it for malicious software.

This software needs to be updated. Contact the developer for more information.

And the access to chromedriver is blocked.

Is there a way for the brew formula to be fixed to avoid this?

[SMillerDev]

https://docs.brew.sh/FAQ#why-cant-i-open-a-mac-app-from-an-unidentified-developer

[JohnMeyerhoff]

If you are asking weather this could be fixed by Brew, the simple answer currently is no. You can however as @SMillerDev mentioned
open the app manually. I have found in the past that the easiest way to do this is:

• Locate the file in Finder
• Hold down control
• Click the application
• Click open
• Confirm the dialogue

Afterwards you should be able to open the app without any hassle.

[jrochkind]

Thanks! Perhaps this Q&A can be google-findable by others running into this same problem, saving them some time and confusion.

The situation confused me even more than this kind of MacOS exec auth issue usually would, since the chromedriver app is not something I normally manually click on or even know where it is, it's normally just transparently used by my build proceses. The message in the terminal "This software needs to be updated. Contact the developer for more information" is also perhaps a bit misdirecting in this case.

After googling more, which chromedriver followed by xattr -d com.apple.quarantine <path_to_chromedriver> also worked, for a solution that happens purely in terminal. As per this Stack Overflow. https://stackoverflow.com/questions/60362018/macos-catalinav-10-15-3-error-chromedriver-cannot-be-opened-because-the-de

If there has been discussion among homebrew maintainers of this general issue in Homebrew and consideration of possible general approaches to it, I'd be interested in reading it if anyone has a link. It is some friction to brew just working, for sure.

[ananyachadha]

it is google-findable by others running into the same problem, thank you!

[seidnerj]

Suggestion: it might be a good idea to add this note to actual brew formula so that this is either done automatically or the user is notified of a way to deal with this issue when running brew in the command line. Another possible solution is of course to have signed binaries for chromedriver which would prevent this issue from happening in the first place.

[alebcay]

chromedriver is distributed as a cask, meaning that all brew does is download the binaries from the upstream provider (https://chromedriver.chromium.org/). The intent is that installing casks does not imply any more or less trust than if one were to download it from the upstream provider.

brew could automatically run the xattr -d command to mark the downloaded file as "trusted" (but this would require sudo for each case, and Homebrew tries to avoid asking for sudo as much as possible), but this is basically inserting Homebrew into the chain of trust between users and casks that are installed. A user is then trusting that every cask installed is reputable and safe, and is basically waiving the ability to individually trust/audit (through Gatekeeper) individual applications. It also puts an additional responsibility on Homebrew maintainers to personally vet the thousands of applications distributed as Casks, for which there is no reasonable way to do (even more so since many are closed-source, require subscriptions, etc.). Keep in mind that users can also add taps containing additional casks available for install - those are even less trusted.

Upstream providers can avoid this issue for end users by signing their binaries (which requires a signing key/account from Apple). This does incur cost, but also means that there is some amount of vetting from Apple. Keys can also be revoked, in the case that a provider/vendor is discovered to be a bad actor.

Alternatively, providers can distribute unsigned binaries but then it is up to end users to explicitly opt-in to trust it in each case (like the current situation described above).

---

On the contrary, formulae distributed by Homebrew are software that have been built by Homebrew's CI process from source. As a result, Homebrew does codesign these where appropriate since Homebrew is essentially acting as a distributor for the binaries themselves in this case.

[seidnerj]

Thanks for the detailed explanation! I guess adding a notification after installation of the cask is the best option. Either this or also having a formulae for chromedriver that builds it from source and then signs the binary locally.