macOS binaries are now code-signed with a Developer ID, hardened, and Apple-notarized. Shell commands got a round of targeted speedups, a Python dlopen codesign regression is fixed, and two long-running DebugAllocator leaks are gone.
nb update # to v0.1.191
tree warm: Homebrew 2.38s → v0.1.083 23ms → v0.1.190 17ms → v0.1.191 17ms
Apple Silicon (M-series), macOS, median of 3 runs. v0.1.191 does not touch the install hot path; the Homebrew speedup the previous release earned is preserved.
Targeted work on the JSON parse, BFS resolver, and nb leaves hot paths. Apple Silicon, macOS, median of 3 runs.
brew leaves reads a local prefix cache; nanobrew had been doing ~100 sequential API fetches with no shared HTTP client and O(n³) membership scans to reach the same answer. v0.1.191 parallelizes those fetches across a bounded worker pool with a per-thread persistent std.http.Client and replaces the scans with a StringHashMap. Net: nanobrew nb leaves is now 1.37× faster than brew leaves while still carrying fresh dep info.
Replaces nb list | grep X; ls $PREFIX/lib | grep X; nb search X with a single aggregated subcommand.
$ nb where opus ==> installed matching "opus": opus 1.6.1 ==> /opt/nanobrew/prefix/bin/ matching "opus": (none) ==> /opt/nanobrew/prefix/lib/ matching "opus": (none) ==> /opt/nanobrew/prefix/opt/ matching "opus": opus@ ==> formula index matches for "opus": libopusenc 0.3 - Convenience library for creating .opus files opus 1.6.1 - Audio codec opus-tools 0.2 - Utilities to encode, inspect, and decode .opus files opusfile 0.12 - API for decoding and seeking in .opus files
macOS tarballs for arm64 + x86_64 code-signed with a Developer ID, timestamped, hardened runtime, and submitted to Apple's notary service. Gatekeeper accepts on first run.
install_name_tool strips signatures unconditionally, and the batch codesign pipe was too small on packages with many Mach-O files. python@3.14 went from 60/76 broken .so + SIGKILL to 0/76 + framework re-sealed.
std.json.Scanner with skipValue() replaces full std.json.Value materialization on the 29.5 MB formula.json + 14.2 MB cask.json. 1.80× faster nb search, 1.68× faster nb info alias resolution.
Aggregates installed kegs/casks/debs, files in $PREFIX/{bin,lib,opt}, and Homebrew formula index hits into one call. Case-insensitive substring match.
Formula info now prints desc, homepage, license, bottle/source URL + sha256, deps, build deps, and caveats — matching the cask info layout. Bottled formulae tag the version as (bottled); source-only tags the URL as (source).
nb outdated was leaking three strings per outdated package on every run. nb info was leaking every formula on the alias path. Both now report zero DebugAllocator leaks.
Works offline after the notarization ticket is fetched once.
| Step | Command | Confirms |
|---|---|---|
| Checksum | shasum -a 256 -c nb-arm64-apple-darwin.tar.gz.sha256 | in-transit integrity |
| Authority | codesign -dv --verbose=4 nb-arm64-apple-darwin | Developer ID + Apple Root CA |
| Runtime | same output — flags=0x10000(runtime) | hardened runtime enforced |
| Structural | codesign --verify --deep --strict nb-arm64-apple-darwin | signature is internally consistent |