Enabling `--require-sha` on all checksum-verifiable Homebrew casks

Require SHA-256 hash on Homebrew casks when it's available

By Jeremy Nguyen
August 8, 2026

shell

homebrew

You may want to set --require-sha as a default option in your Homebrew casks for extra security, either with the environment variable HOMEBREW_CASK_OPTS="--require-sha"¹ or by adding cask_args require_sha: true to your Brewfile.²

As Homebrew itself has noted, casks, which use prebuilt binaries from an upstream source, have a different security model compared to formulae built by Homebrew. At the very least, enabling --require-sha will guarantee that the downloaded cask has not changed since it was last reviewed by a Homebrew maintainer.³

The thing is: many Homebrew casks do not have a SHA-256 checksum because their download link is not versionable.⁴ The top ten casks in Homebrew/homebrew-cask that have "no_check" set for their SHA-256 according to their JSON analytics data as of August 7, 2026 are the following:⁵

Cask	Place	Install Events (365 days)	%
google-chrome	#6	449,427	1.81%
spotify	#48	97,716	0.39%
chromium	#83	57,790	0.23%
steam	#106	46,666	0.19%
google-drive	#119	39,690	0.16%
logi-options+	#120	39,532	0.16%
font-source-code-pro	#187	19,784	0.08%
anydesk	#200	18,714	0.08%
termius	#233	15,240	0.06%
onyx	#240	14,807	0.06%
google-gemini	#276	11,895	0.05%

For more information on this concern, see the following issue on GitHub: Homebrew/homebrew-cask#147305. Hence, enabling --require-sha with any of the above casks installed will lead to this error:⁶

...
==> Verifying checksum for '89947a18e10d5bbda8e2b5d15a60b6823353f019ea1a4b74e3d9c4f91248776e--chromium.rb'
==> Checking cask has checksum
Error: Cask 'chromium' does not have a sha256 checksum defined and was not installed.
This means you have the --require-sha option set, perhaps in your HOMEBREW_CASK_OPTS.
/opt/homebrew/Library/Homebrew/cask/installer.rb:177:in `verify_has_sha'
...

Hopefully, in the future, a feature like pnpm's no-downgrade could be added, where a cask cannot be installed if it now lacks a SHA-256 checksum when it had one previously. A feature such as the aforementioned request for a per-cask option could also prevent this issue.

For now, to quickly enable SHA-256 checksum verification for the casks in your Brewfile that have one available, run the following command:

brew info --cask --quiet --json=v2 $(brew bundle --global list --cask --quiet) | jq --raw-output '
  .casks[]
  | if .sha256 == "no_check" then
      "cask \"\(.token)\" # See Homebrew/homebrew-cask#147305"
    else
      "cask \"\(.token)\", args: { require_sha: true }"
    end
'

This will output the casks portion of the Brewfile (minus pinning, extra arguments, etc.) into stdout and enable require_sha only on the casks that have a SHA-256 checksum.

Comments