Homebrew actually has full provenance. We added it in 2024 (I think, that’s from memory). We never flipped the default verification policy because of some integration concerns, but my understanding is that various downstreams and MDMs do consume and verify Homebrew’s attestations.
replyEdit: I should qualify: Homebrew’s own processes verify its attestations. But that’s not enabled by default on end user machines because it slows installations down and currently requires the `gh` CLI. Neither of those is a tenable long term constraint for a default feature.
For curious readers, to turn it on:
replybrew install gh echo HOMEBREW_VERIFY_ATTESTATIONS=1 >> $HOME/.zshrc brew verify gh
Downloading attestations will be quicker if you are logged in to github: gh auth login gh auth status
For a box you don't want full login privs on, you can use a GH PAT token with minimal privs.
If too slow/GitHub down:
HOMEBREW_NO_VERIFY_ATTESTATIONS=1 brew upgrade