YAHI: Yet Another Homebrew Installation

A recent refactor of SYM-Lite led to a happy accident for fresh installs of Homebrew with Standard macOS users

Slideshow

Background

During a recent refactor of SYM-Lite (1.6.0), I switched Homebrew’s initial installation from an internal, scripted approach to the official .pkg via Installomator.

While Homebrew was technically installed, its installation was in a state of flux: git was missing, meaning that (at least) the following commands were sideways:

• brew -v
• brew update
• brew upgrade

I started down the [Feature]: Auto-install git via Homebrew when missing so brew isn’t degraded road, but ended up with:

dan@Mac ~ % brew -v
Homebrew 7.0.9-dirty

That -dirty suffix means the tracked files in Homebrew’s own git checkout don’t match HEAD. Homebrew mostly worked (bottles and casks still installed), but a brewed git arrives too late to tidy up a checkout that was laid down without one, and leaving every Standard user with a “dirty” Homebrew wasn’t an option.

To my utter amazement, a four-year-old script by Rich Trouton still worked as expected with macOS 27.2 Beta 3, so I closed Feature Request #26 as “not planned,” and opened [Feature]: Install Command Line Tools when git is missing so Homebrew isn’t degraded.

Secret Sauce

The “secret sauce” of this approach was to first install Apple’s Command Line Tools only when git wasn’t already present on the Mac.

Homebrew’s .pkg includes a postinstall script which resets its freshly installed checkout (git reset --hard and git clean -f -d), but only when xcode-select -print-path points to a developer directory which actually contains git.

No git, no reset, and -dirty it is.

Installing the Command Line Tools after Homebrew restores git, but doesn’t clean up an already-dirty checkout.

So, SYM-Lite (1.6.0) changes the order of operations:

1. Look for git in the active developer directory, /Library/Developer/CommandLineTools, /Applications/Xcode.app, and a brewed git under the Homebrew prefix, using file tests only (SYM-Lite never runs /usr/bin/git, because that stub would greet your users with Apple’s “Install Command Line Tools” prompt)
2. Install the Command Line Tools as root via softwareupdate when git is missing, using the on-demand trigger file from Rich’s script (embedded in SYM-Lite; never downloaded at runtime)
3. Install Homebrew via Installomator’s homebrew label, whose postinstall now finds git and leaves a clean checkout
4. Log brew --version once per run; a -dirty result logs a [WARNING] suggesting brew update-reset

Stripped of SYM-Lite’s hardening (i.e., refusing to follow a user-planted file in world-writable /tmp, skipping betas, version-aware sorting and streaming everything to the log), Rich’s approach boils down to:

# Make softwareupdate offer the Command Line Tools
touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress

# Find the newest Command Line Tools label …
softwareupdate --list | grep "Label: Command Line Tools"

# … and install it
softwareupdate --install "Command Line Tools for Xcode-[version]" --verbose

rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress

Here’s the “happy accident” for Standard users: since SYM-Lite runs as root from a Jamf Pro policy, the Command Line Tools install needs no admin credentials, no logged-in user and no prompts.

Homebrew commands themselves still run as the logged-in user with HOMEBREW_NO_SUDO=1 (so nothing hangs on a password prompt), and casks for non-admin users land in ~/Applications.

A few caveats:

• The Command Line Tools come from Apple’s software update catalog and CDN; softwareupdate --list alone can take a minute or more, and the download is large, so plan on several minutes. Inspect Mode shows a Command Line Tools (for Homebrew) row (and a leading side message) so users know it’s working, even without visible progress.
• Offline Macs, a blocked Apple CDN or MDM-deferred updates log a [WARNING] and the run continues; bottles and casks still install without git, but brew update is skipped and third-party taps fail.
• Not your cup of tea? Set homebrewAutoInstallCommandLineTools="false" and SYM-Lite only logs a [WARNING] when git is missing.

Implementation

After successfully deploying SYM-Lite (1.6.0) or later in your environment, create a new, dedicated policy for initial Homebrew installations, which effectively will be automating the following command:

sudo /path/to/SYM-Lite.zsh "" "" "" "interactive" "homebrew" 375

Parameters 1 through 3 are reserved by Jamf Pro (hence the three empty strings); the remaining three are configured in the policy’s Scripts payload:

• Parameter 4: interactive
  The logged-in user sees the selection dialog, Inspect Mode progress and the completion dialog (i.e., ideal for Self Service)
• Parameter 5: homebrew
  In interactive mode, a non-empty Parameter 5 acts as an allowlist, so the selection dialog shows only Installomator’s homebrew label
• Parameter 6: 375
  Dialog height, in pixels (default: 675); anything below 500 switches Inspect Mode to swiftDialog’s Preset 3 (Compact), sized at 900 × 375 to match the selection and completion dialogs

Make the policy available in Self Service (with an Execution Frequency of Ongoing), scope it to your Homebrew-eligible Macs, and the slideshow above is what your Standard users will see.

When the dust settles, the client-side log should include Command Line Tools installed; git at /Library/Developer/CommandLineTools/usr/bin/git, and Homebrew should be squeaky clean:

dan@Mac ~ % brew -v
Homebrew 7.0.9

A few related tips:

• Homebrew casks and formulae are hidden until brew is installed, so pair this policy with a second one listing your approved items in Parameter 5 (e.g., cask:1password-cli,cask:claude-code,cask:codex,formula:direnv).
• Already have Macs with a -dirty Homebrew? The Command Line Tools alone won’t clean an existing checkout; once git is present, have the user run brew update-reset.
• Interactive mode disables already-installed items, so to add the Command Line Tools to an existing Homebrew which lacks git, select a Homebrew item which isn’t installed yet, or run silent mode with homebrew in Parameter 5.

As always, YMMV.

Support

Community-supplied, best-effort support is available on the Mac Admins Slack (free registration required) in the #setup-your-mac channel, or you can open an issue on GitHub.