Repository navigation
Homebrew sandbox breaks brew python venv installation on Tahoe #377
Description
How to recreate:
Brand new ec2 mac instance, run brew install aws/aws/amazon-efs-utils
✔︎ Formula amazon-efs-utils (2.4.2) Verified 220.0KB/220.0KB
==> Installing amazon-efs-utils from aws/aws
==> python3 -m venv --system-site-packages --without-pip /opt/homebrew/Cellar/amazon-efs-utils/2.4.2/libexec
==> python3 -m pip --python=/opt/homebrew/Cellar/amazon-efs-utils/2.4.2/libexec/bin/python install /private/tmp/s-GDCNtJvO/amazon-efs-utils--atomicwrites-20260918-61597-1ptaaw/atomicwrites-1.4.1
Last 15 lines from /Users/ec2-user/Library/Logs/Homebrew/amazon-efs-utils/02.python3.log:
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/setuptools/
Could not fetch URL https://pypi.org/simple/setuptools/: There was a problem confirming the ssl certificate: ('OSStatus -26276',) - skipping
ERROR: Could not find a version that satisfies the requirement setuptools>=40.8.0 (from versions: none)
ERROR: No matching distribution found for setuptools>=40.8.0
error: subprocess-exited-with-error
Analysis
pip’s macOS system-trust backend fails inside Homebrew’s sandbox.
Workaround
A targeted workaround is to add this to the formula:
--- /opt/homebrew/Library/Taps/aws/homebrew-aws/Formula/amazon-efs-utils.rb_orig 2026-08-18 03:15:00
+++ /opt/homebrew/Library/Taps/aws/homebrew-aws/Formula/amazon-efs-utils.rb 2026-09-18 18:26:26
@@ -167,6 +167,7 @@
end
def install
+ ENV["PIP_USE_DEPRECATED"] = "legacy-certs"
venv = virtualenv_create(libexec, "python3")
%w[atomicwrites attrs botocore configparser coverage entrypoints flake8 funcsigs jmespath mccabe
mock more-itertools packaging pbr pluggy py pycodestyle pyflakes pyparsing pytest pytest-cov pytest-htmlThen retry as ec2-user:
$ HOMEBREW_NO_AUTO_UPDATE=1 /opt/homebrew/bin/brew install --verbose aws/aws/amazon-efs-utilsThis retains HTTPS certificate verification using pip’s bundled CA certificates, while avoiding the macOS system-trust backend
Activity
[-]Homebrew sandbox breaks Homebrew installation on Tahoe[/-][+]Homebrew sandbox breaks brew python venv installation on Tahoe[/+]aaljewarane commentedon Sep 21, 2026
@jorhett Could you verify what Homebrew version you are encountering this issue on?
jorhett commentedon Sep 21, 2026
I get asking questions that are relevant, but I don't understand why this question is. Homebrew doesn't allow you to run old versions for more than a few days. It updates on every invocation. It has changed several times, only a few hours apart, between when I posted this and when you asked.
At the time I reported this it was 7.0.4. At the moment it's 7.0.6. By the time you read this it will have likely changed again.
aaljewarane commentedon Sep 28, 2026
I understand, the reason I ask this is to pinpoint the reproduction. This seems to be an issue with the new macOS allowlist from Homebrew 7. I just wanted to confirm that you are only seeing this on 7 as well or else we have a bigger issue on our hands.
Homebrew/brew@0190b03
Here is the relevant commit if you are interested. Anyways, I am working on filing an issue on GitHub with Homebrew themselves to see if we can re-allowlist com.apple.trustd.
aliyajo commentedon Nov 4, 2026
Hi @jorhett, thanks for the report. This was caused by a Homebrew sandbox change and was fixed upstream in Homebrew/brew#24126.