homebrew-core: qemu: `invalid signature (code or signature have been modified)` (regression in 8.0.4, fixed in 8.0.4-1, re-regression in 8.1.0)

brew gist-logs <formula> link OR brew config AND brew doctor output

$ brew config
HOMEBREW_VERSION: 4.1.6-8-g4564628
ORIGIN: https://github.com/Homebrew/brew
HEAD: 4564628eaf54264c9f3c69ba83c045ceb1742de2
Last commit: 17 hours ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: 08799a75aac5d4bcee13abe6113063dae904861b
Core tap last commit: 5 hours ago
Core tap branch: master
Core tap JSON: 23 Aug 05:21 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.XXXXXXXXXX/org.xquartz:0
HOMEBREW_MAKE_JOBS: 8
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: octa-core 64-bit icelake
Clang: 14.0.3 build 1403
Git: 2.42.0 => /usr/local/bin/git
Curl: 8.1.2 => /usr/bin/curl
macOS: 13.5-x86_64
CLT: 14.3.1.0.1.1683849156
Xcode: 14.3

$ brew doctor
Your system is ready to brew.

Verification

• My “brew doctor output” says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.

What were you trying to do (and why)?

/usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64 -accel hvf for running a QEMU machine with Hypervisor.framework (HVF)

What happened (include all command output)?

It crashes, as the signature on the binary is broken:

$ /usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64 -accel hvf
qemu-system-x86_64: -accel hvf: Error: HV_DENIED
Abort trap: 6

$ codesign --verify /usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64 
/usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64: invalid signature (code or signature have been modified)
In architecture: x86_64

What did you expect to happen?

The signature shouldn’t be broken.

Step-by-step reproduction instructions (by running brew commands)

$ brew install qemu

$ /usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64 -accel hvf
qemu-system-x86_64: -accel hvf: Error: HV_DENIED
Abort trap: 6

$ codesign --verify /usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64 
/usr/local/Cellar/qemu/8.1.0/bin/qemu-system-x86_64: invalid signature (code or signature have been modified)
In architecture: x86_64

---

This was a regression in 8.0.4 bottle (https://github.com/Homebrew/homebrew-core/pull/139409), and was once fixed in its rebuild 1, (https://github.com/Homebrew/homebrew-core/pull/139492 , https://github.com/Homebrew/brew/pull/15864), but broken again in 8.1.0.

---

Workarounds

Option 1: Downgrade QEMU to v8.0.3

brew uninstall qemu
curl -OSL https://raw.githubusercontent.com/Homebrew/homebrew-core/dc0669eca9479e9eeb495397ba3a7480aaa45c2e/Formula/qemu.rb
brew install ./qemu.rb

Option 2: Install QEMU from the source

brew uninstall qemu
brew install --build-from-source qemu

Option 3: Sign the QEMU binary locally

Lima v0.17.2 shows a prompt to suggest applying this workaround.

cat >entitlements.xml <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.hypervisor</key>
    <true/>
</dict>
</plist>
EOF

codesign --sign - --entitlements entitlements.xml --force /usr/local/bin/qemu-system-$(uname -m | sed -e s/arm64/aarch64/)