Webinar: Mac Software Management for MSPs: From Visibility to Governance
Register now
Security and Compliance
Guide

Review unregistered Taps

Petros Amoiridis

This guide shows how to work through the Unregistered Taps list in the Workbrew Console, registering the third-party Taps you trust and removing the rest from your Devices.

A Tap shows up here when a Device reports it, or has Packages installed from it, and nothing in your Workspace vouches for it yet. Official Homebrew Taps, private Taps you provision in Workbrew and Taps you have already registered never appear. For why vouching for a Tap matters, see How Workbrew handles Homebrew Tap trust.

You need the Admin role to register or untap. Other roles can view the list.

Open the list

Go to Packages > Taps and select the Unregistered Taps tab. While the list has Taps you can act on, Admins also see an "unregistered taps to review" item under the notification bell that links here.

The list has three groups, and each asks a different question. Start at the top.

Check Taps at custom remotes

The Custom remotes group lists Taps whose reported remote is somewhere other than the Tap's usual GitHub address, such as your own Git server. Each row shows the Tap name, the remote Devices report it from and the Devices that report it.

For each row, confirm the remote really is the Tap it claims to be. Then do one of the following.

  1. If you trust it, click Register on the row. The form is prefilled with the Tap name and the reported remote. Check the remote and click Register tap.
  2. If you don't, untap it (see Untap the rest).

Registering makes that remote the Tap's confirmed one, so Workbrew trusts the Tap on Devices that report it there. It does not allow installs on its own. An Allowed Taps Policy still decides that.

The same Tap can appear on several rows when Devices report it from different addresses. Register the address you want everyone on, and move or untap the others.

Decide on Taps at standard GitHub locations

The Standard GitHub locations group lists Taps at their usual GitHub address, which is what brew tap owner/repo produces. Their identity is already clear, so the only question is whether your Workspace uses them.

  • To register every Tap in the group, click Register all and confirm.
  • To pick, click Register on the rows you recognize and untap the rest.

The Devices column shows which Devices have each Tap, if you'd like to ask before removing one.

Leave Taps with no reported remote for now

The No reported remote group lists Taps from Devices running older Workbrew Agents, which can't report where a Tap came from. It also lists Taps that Devices installed Packages from but no longer report. Updating those Devices sorts most of the first kind into the other two groups, so this group can usually wait.

Untap the rest

Untap removes a Tap from the Devices that report it. It runs brew untap --force, which uninstalls every formula and cask installed from that Tap before removing it. Untap only appears when your Workspace has Brew Commands, and only on rows where at least one Device still reports the Tap.

  1. Click Untap on the row.
  2. Read the dialog. It says how many Devices it will run on and how many formulae and casks Homebrew will uninstall. If that number isn't zero, someone is probably using a tool from this Tap. Find the Tap on the In Use tab and click its Formulae Installed or Casks Installed count. That lists each package from the Tap with the Devices that have it installed. Check with those people first, or register the Tap instead.
  3. Click the Untap button in the dialog to send the command.

Devices whose Homebrew is read-only are skipped. A row clears once every Device has removed the Tap.

Change your mind later

Registered Taps move to the Registered Taps tab. To undo a registration, unregister the Tap there. That removes its trust and any Policy rules that reference its Packages, and, when your Workspace has Brew Commands, untaps it from the Devices that report it.