grew

✨ What it does

🚀 Getting Started

1. Get grew

The fastest way — downloads the latest release binary with dual SHA-256/512 verification:

go install github.com/homegrew/grew/tools/getgrew@latest
getgrew
sudo grew setup

Or build from source

Prerequisites: Go 1.26+, git, and a dream.

git clone https://github.com/homegrew/grew.git
cd grew
make build          # or: go generate ./internal/... && go build -o grew

2. Set up the prefix

grew needs a home — a directory tree for the Cellar, symlinks, taps, and config:

sudo ./grew setup   # macOS ARM → /opt/homegrew, Intel/Linux → /usr/local/homegrew

The system prefix isolates sandboxed builds from $HOME, preventing them from reaching ~/.ssh, ~/.gnupg, or other sensitive dotfiles. After setup, ownership is transferred to your user — no root needed at runtime.

3. Wire up your shell

# bash (~/.bashrc) or zsh (~/.zshrc)
eval "$(grew shellenv)"

# fish (~/.config/fish/config.fish)
grew shellenv fish | source

4. Install something

grew install jq                # the classic
grew install -s ldns           # build from source, like a purist
grew install --cask firefox    # going big

That's it. No dark rituals. No 47-step setup guide.

📖 Day-to-day usage

grew link jq                   # stitch it in
grew deps --tree jq            # what hath jq wrought
grew upgrade                   # stay fresh
grew cleanup -n                # peek before you sweep
grew verify jq                 # check installed files against manifest
grew vuln-scan                 # scan for CVEs and integrity issues
grew lock                      # pin your environment
grew audit --strict            # lint your formulas
grew doctor                    # check for common problems

🗑️ Uninstallation

grew stores most of its data in its prefix directory, but some items (like Cask applications and background services) are linked to system directories. To completely remove grew and all of its traces:

1. Clean up installed packages (Casks and Services)

# Stop and remove all background services
for s in $(grew services ls | awk 'NR>1 {print $1}'); do grew services stop $s; done

# Uninstall all macOS casks
for c in $(grew list --cask | awk '{print $1}'); do grew uninstall --cask $c; done

2. Delete the prefix directory

# macOS (Apple Silicon):
sudo rm -rf /opt/homegrew

# macOS (Intel) & Linux:
sudo rm -rf /usr/local/homegrew

# Devmode (User-local install via --unsafe):
rm -rf ~/.homegrew

3. Clean up your shell profile

Open your shell configuration file (e.g., ~/.zshrc, ~/.bashrc, or ~/.config/fish/config.fish) and remove the line that initializes grew:

# Remove this line:
eval "$(/opt/homegrew/bin/grew shellenv)"

Restart your terminal, and grew is completely gone.

🗺️ Commands

⚙️ Configuration

grew keeps its stuff tidy under one roof. Tweak it with env vars:

Directory Structure

Everything flows from the prefix:

/opt/homegrew/              (or /usr/local/homegrew on Intel/Linux)
├── Cellar/        ← installed packages (each keg has a .MANIFEST.json)
├── Taps/          ← formula definitions (git-cloned or API-fetched)
├── bin/           ← symlinked binaries
├── lib/           ← symlinked libraries
├── include/       ← symlinked headers
├── opt/           ← per-formula keg symlinks
├── etc/           ← trusted-keys (Ed25519 public keys, one per line)
├── tmp/           ← ephemeral stuff
├── var/log/       ← audit log
└── grew.lock      ← lockfile (opt-in, created by `grew lock`)

🔐 Security: grew vs Homebrew

grew is designed to be more secure than Homebrew out of the box:

Gradual rollout: signature verification doesn't block installs until you add keys to etc/trusted-keys. Tap verification is opt-in via HOMEGREW_TAP_VERIFY. Adopt security features at your own pace.