Homebrew tightens tap security, begins work on its interface Anyone who installs software through a third-party Homebrew tap runs Ruby code written by people outside the project, and that code runs without a sandbox. That risk sits at the center of Homebrew 6.0.0. Tap trust Homebrew now requires a tap, along with any tap-qualified formula or cask, to be trusted before its code is evaluated or run. The official Homebrew taps stay trusted by default. The brew tap command gains options for managing trust and can trust a tap by its remote URL, and brew tap-info reports a trusted field. The brew bundle command honors a trusted option, and brew bundle dump records trusted entries. Sandboxing and security fixes A Bubblewrap sandbox arrives on Linux and aligns it with macOS, where build, test,…