nanobrew v0.1.193

All the v0.1.192 speed. Audit-hardened.
119.4x faster than Homebrew. 12.9x faster than apt-get.

Install path is unchanged from v0.1.192 — every speed number on this page still holds. What's new is 38 commits and 20+ targeted bug fixes from a multi-agent + manual audit, a new nb cleanup --prune-kegs flag, and honest disclosure of the pre-existing apt-replacement teardown bug.

macOS arm64 and x86_64 tarballs are Developer-ID-signed, hardened-runtime, and notarized by Apple.

nb update # to v0.1.193
119.4x faster than Homebrew on yt-dlp target reinstall (inherited from v0.1.192)
12.9x faster than apt-get on git + vim + build-essential (116 deps, Ubuntu 24.04)
5.8ms already-installed no-op on the sandboxed CI yt-dlp benchmark

yt-dlp target reinstall: nanobrew 48.8ms → zerobrew 1830.7ms → Homebrew 5827.7ms. git+vim+build-essential: nanobrew 3402ms → apt-get 43,833ms. Numbers are from the v0.1.192 baseline; v0.1.193 keeps the same install pipeline intact while fixing 20+ correctness bugs around it.

macOS — nanobrew vs Homebrew (warm)

Already-installed reinstalls. Apple Silicon (GitHub Actions macos-14), median of 3 runs. Same install pipeline as v0.1.192; v0.1.193 doesn't move these.

tree 0 deps
452x faster than Homebrew
Homebrew
4070ms
zerobrew warm
242ms
nb v0.1.193
9ms
ffmpeg 11 deps
49.7x faster than Homebrew
Homebrew
14252ms
zerobrew warm
2147ms
nb v0.1.193
287ms
wget 6 deps
146x faster than Homebrew
Homebrew
3935ms
zerobrew warm
587ms
nb v0.1.193
27ms

Linux / Docker — nb install --deb vs apt-get

Ubuntu 24.04 LTS (aarch64, Docker/Colima), median of 3 runs. Warm = NBIX binary index cache + cached .deb blobs, --skip-postinst. Audit-fixed in v0.1.193: cwd-independent nb remove --deb, native xz lifecycle, threadsafe postinst Io, serialized patchelf.

curl + wget 35 packages
7.6x faster than apt-get
apt-get
3426ms
nb v0.1.193 warm
448ms
curl + wget + tree + jq + htop + tmux 53 packages
6.9x faster than apt-get
apt-get
3584ms
nb v0.1.193 warm
521ms
git + vim + build-essential 116 packages
12.9x faster than apt-get
apt-get
43833ms
nb v0.1.193 warm
3402ms
nginx + redis-server + postgresql-client 78 packages
3.9x faster than apt-get
apt-get
5501ms
nb v0.1.193 warm
1402ms

CI package-manager comparison — yt-dlp

Same sandboxed macOS Actions benchmark as v0.1.192. Target reinstall means dependencies and cache/store were primed, then only yt-dlp was removed and installed again as nb install --shims yt-dlp. v0.1.193 keeps the same install path, so the numbers carry over.

target reinstall lower is better
119.4x faster than Homebrew
Homebrew 5.1.7
5827.7ms
zerobrew 0.2.1
1830.7ms
nb v0.1.191
3385.2ms
nb v0.1.193
48.8ms
already installed no-op lower is better
186.8x faster than zerobrew
nb v0.1.191
3183.7ms
zerobrew 0.2.1
1083.2ms
Homebrew 5.1.7
916.9ms
nb v0.1.193
5.8ms

What got fixed in this cycle

38 commits since v0.1.192. Grouped by area. Every entry maps to a commit on main or a closed issue. Most were caught by an internal multi-agent audit pass; the rest came from real user reports (credited below).

apt-replacement (.deb install path)
nb remove --deb is now cwd-independent · absolute paths in state.json going forward, with back-compat for older relative-path DBs · native xz decompress releases its Decompress buffer through deinit instead of the original pointer · postinst execution receives the caller's Io so subprocess spawns don't hit the failing singleton allocator · five other correctness fixes in the apt-replacement path bundled together.
ELF / patchelf
patchelf auto-install serialized across parallel workers · apt-get update before patchelf auto-install · literal /home/linuxbrew/ paths repaired in ELF needed-paths and a symlinked etc/ handled correctly (closes #269 — imagemagick + libheif).
Process-wide threadsafe Io accessor
Call sites that previously reached for std.Io.Threaded.global_single_threaded.io() now share an accessor seeded from main. The default initializer falls back to the singleton so tests and any pre-main use still see a valid Io. Fixes intermittent races during parallel extract/store and the singleton call-site sweep that surfaced under nb install --deb reinstalls.
Install pipeline
nb install threads io through the install path to fix Linux CopyFailed from incompatible Io in std.process.run (closes #276) · @@HOMEBREW_*@@ relocation now correctly rewrites files >1 MiB and locale subtrees that previously slipped through · nb upgrade rejects unknown flags and uninstalled package names instead of silently no-op'ing.
Diagnostics + cleanup
New: nb cleanup --prune-kegs drops phantom state.json entries pointing at kegs that no longer exist on disk (closes #279) · nb doctor now points at this flag when it spots phantom entries · hint when the 256-entry batch cap is hit so users know to re-run.
Memory + parser safety
DB parser partial-allocation leaks in pushHistory and install paths now cascade-free already-successful dupes when a later step fails · nb services list memory leaks plugged.
Networking polish
HTTP User-Agent override (instead of append) so requests no longer leak zig/0.16.0 (std.http) to upstream endpoints that filter on UA (closes #258 — fixes the Warp vendor download).

The new flag in action

After upgrading from v0.1.191 with nb update, nb doctor proactively points at the new prune flag.

$ nb update
==> Updating nanobrew...
==> Downloading v0.1.193 (arm64-darwin)...
==> Verifying checksum...
==> Checksum verified, extracting...
==> Updated nanobrew to v0.1.193 (was v0.1.191)

$ nb doctor
==> Checking nanobrew installation...
   /opt/nanobrew is writable
   DB entry 'alsa-lib' has no Cellar dir (run nb cleanup --prune-kegs to remove)
   DB entry 'sag' has no Cellar dir (run nb cleanup --prune-kegs to remove)

$ nb cleanup --prune-kegs
  Pruned phantom keg: alsa-lib 1.2.15.3
  Pruned phantom keg: sag
==> Reclaimed 22.6 MB

Known issue: nb install --deb exits 139 on Linux

Files install correctly, but the process exits with SIGSEGV at teardown. This is pre-existing since v0.1.190 and tracked under CI's continue-on-error: true # Known Zig std.http.Client + musl TLS segfault. The crash is in runtime/libc teardown after main() returns; install/extract/postinst all complete and the files are present on disk. Reproducible cleanly under Apple container; usually masked in tests/deb-parity.sh by piping nb output through tail, which absorbs the signal. v0.1.193 documents this honestly rather than silently shipping over it again. Workaround for Dockerfile users: pipe through tail or wrap in ( … ) || true so a downstream RUN step doesn't fail. Tracked as a release-blocker for the next cycle.

Public issue credits

Thanks to @noripcord for #269 — imagemagick with libheif support being broken. That report drove the literal /home/linuxbrew/ ELF path repair and the etc/ symlink handling.

Thanks to @gavmor for #276nb install failing with CopyFailed on Linux due to incompatible Io in std.process.run. That report drove the install-path io threading fix.

Release artifacts

arm64

macOS arm64

nb-arm64-apple-darwin.tar.gz
signed (Developer ID Application: Rachit Pradhan, WWP9DLJ27P), hardened-runtime, notarized by Apple.

x86_64

macOS x86_64

nb-x86_64-apple-darwin.tar.gz
built against minos 12.0, signed, hardened-runtime, notarized. x86 smoke-tested under Rosetta before packaging.

arm64

Linux aarch64-musl

nb-aarch64-linux.tar.gz
statically linked single binary, no runtime deps.

x86_64

Linux x86_64-musl

nb-x86_64-linux.tar.gz
statically linked single binary, no runtime deps.

How to read this release

v0.1.193 isn't a speed release. It's a confidence release.

QuestionAnswer
Should I upgrade from v0.1.192?Yes. Strict improvement — same install-path performance, plus 20+ correctness fixes and the new prune flag.
Will nb install --deb work in my Dockerfile?The files will install correctly, but the RUN step will exit 139 unless you pipe through tail or wrap in ( … ) || true. Tracked for the next release.
Are macOS tarballs notarized?Yes — both arm64 and x86_64. Gatekeeper fetches the ticket online on first run; browser downloads no longer prompt as "unidentified developer".
Did anything get faster?Not deliberately. The audit was about correctness. Existing perf claims from v0.1.192 still hold on the same hardware.
What's the new feature?One: nb cleanup --prune-kegs for cleaning phantom DB entries. nb doctor points at it when it spots them.