PACKAGE MANAGER SANDBOXING

Summary from the TLDR InfoSec newsletter

Homebrew developer Andrew Nesbitt explains Homebrew 7.0's split fetch and install phases as well as the Landlock and Seatbelt-based sandboxes. Nesbitt then reviews the sandbox implementations, allowlist implementations, and sandbox proposals from other package managers. Some package managers like Go and Elm go a step further by fully removing code execution.