Hardscrabble 🍫

By Max Jacobson

See also: the archives and an RSS feed

How and why to use an SSH passphrase

May 1, 2023

While writing about git commit signatures earlier today, a related memory came to mind.

A few months in to my working at Code Climate, back in mid 2016, I confessed to a colleague that I didn’t have a passphrase associated with my SSH key. His eyes filled with horror, and he said “For God’s sake, use a passphrase, man!”1

SSH Keys are used as an authentication mechanism for some very sensitive things like read/write access to remote git repositories and for managing access to remote servers.

But, anecdotally, I feel like a lot of people don’t use passphrases with their SSH keys… So let’s talk about it.

When you generate an SSH Key, you get a pair of text files on your computer. On my computer, I have these two files:

$ ls ~/.ssh
id_ed25519
id_ed25519.pub

The first one is the private key and the second one is the public key. The public key is the one I give out, and the private one is really important for me not to share with anyone at all.

(Yours might be named id_rsa and id_rsa.pub, or something else, but it will come in a pair of a public key and a private key.)

When I add my public key to my github.com account, and that lets me clone private repositories as long as I have the corresponding private key.

We can imagine a scenario where my private key is compromised. Maybe I’m at a coffee shop and I run to the bathroom and forget to lock my laptop. The snoop sitting next to me might quickly run cat ~/.ssh/id_ed25519, take a photo, and then close the terminal window. Now they have my private key, and they can use it from their computer to access whatever I can access.

Eep.

When generating an SSH key, the ssh-keygen command will ask you whether you would like your key to have a passphrase. If you say no, you’re vulnerable to the cafe snoopers of the world2.

If, however, you do provide a passphrase, your private key will be useless to the snooper, because they will need to type in the passphrase when they try to use the key.

Of course, that means that you will also need to type in the passphrase when you try to use the key. That’s super annoying! You probably push and pull several times throughout the day, and if your passphrase is convenient to type, it’s probably not that strong of a passphrase.

To mitigate that annoyance, I have this line in my ~/.zshrc:

ssh-add -q --apple-use-keychain

The effect of this is that I only need to enter the passphrase once, and it will remember it forever. I guess it stores it in the keychain, some secure thing that the Mac manages. I don’t really get how the keychain works to be honest.

But the user experience is pretty great: I have a passphrase, so I can sleep easy at night, but I don’t need to deal with the hassle of entering it all the time.

  1. I paraphrase from memory 😅. ↩

  2. perhaps a more likely scenario is an attacker stealing your laptop, unscrewing the bottom, yanking the hard drive out, and rummaging around in your files. But if your disk is encrypted, you shouldn’t need to worry about this. ↩

How to sign your git commits with the SSH key you already use

May 1, 2023

It’s surprisingly easy to impersonate other people in git and GitHub. All you need to know is their name and email address, and then you can configure git with that information and start committing. When you push those commits to GitHub, it looks up the user by email address and attributes the commit to that user, whether or not they actually made it.

For example, if you want to impersonate dhh on GitHub, all you have to do is:

git config --global user.name "David Heinemeier Hansson"
git config --global user.email "dhh@hey.com"

And then start committing and pushing.

impersonating DHH

But, uh, please don’t actually do that, I don’t want to get in trouble.

Being impersonated is not likely to be a big problem for you, but if it’s something you’re worried about, you should start signing your commits. Honestly, you should probably just start signing your commits anyway, because it’s kind of neat and just got way, way easier1.

Here’s what you do:

git config --global commit.gpgSign true
git config --global gpg.format ssh
git config --global user.signingKey "~/.ssh/id_ed25519"

The user.signingKey config should be a path to your private SSH key. It’s possible that your private SSH key has a different path, such as ~/.ssh/id_rsa, so you may need to tweak that.

This bit is optional, but if you use tags, you can also sign those:

git config --global tag.gpgSign true
git config --global tag.forceSignAnnotated true

If you’re following along, now’s a good time to try making a commit and confirm that it works. If anything doesn’t work, you can always undo those configuration changes by editing ~/.gitconfig. But hopefully it does!

When you push these commits to GitHub, you will see an “Unverified” badge next to them until you let GitHub know that you’re using this SSH Key to sign commits now. You can do that by copying your public key to your clipboard (cat ~/.ssh/id_ed25519.pub | pbcopy) and then adding it, taking care to select “Signing Key” as the key type.

If you’re actually worried about being impersonated, you can also turn on vigilant mode which will display that “Unverified” badge on any commits that aren’t signed by one of your registered signing keys.

Note that this signature only exists for commits that are authored locally on your machine. What about commits you author through GitHub’s web interface? For example when you merge a PR, or edit a file on the web. Actions like those will create commits on GitHub’s servers, which don’t have access to your private key for signing. You might be surprised to see that those commits also have a “Verified” badge on them. What gives? If you look a little closer (by clicking on the badge to reveal some details) you’ll see that those commits are signed by GitHub, not by you.

This commit was created on GitHub.com and signed with GitHub’s verified signature.

GitHub is basically saying that they created the commit on behalf of a particular GitHub user. They know who clicked the big green merge button, and they’re vouching for you.

  1. it used to be that you would sign your commits with gpg, but gpg is kind of confusing and finicky to set up. For a while I used a tool called bpb which makes it a little easier, but it was still finicky. Recently GitHub added support for signing commits with the SSH key you already have and I was thrilled to ditch that bpb setup. ↩

Natasha Beats The Devil

April 21, 2023

In 2004, Natasha Bedingfield released a track called These Words. In 2006, 65daysofstatic released a remix called Natasha Beats The Devil:

I would have found this via Jerome Holeyman’s blog charlatan, which I was a religious reader of back in the Google Reader days, which covered the hard-to-define genre called Post-Rock.

I can’t really imagine listening to this without watching the video. The video is inseparable, remixing the original music video.

In just a few short minutes, this video reliably restarts my brain. The remix starts out humble, not varying too much from the original song (which is also great). But at some point, when it’s supposed to segue from that perfect chorus (“I love you, I love you”) into a bridge and then wind down, it just… doesn’t. It just stays there, like a glitch happened. Like she was supposed to take a turn, drove off a cliff, and her car started flying. “I love you, I love you” becomes IloveyouIloveyouIloveyouIloloveyouIIloveyou. Natasha beats the devil. A new glitchy beat comes in, and some simple chords, and she keeps going, for what feels like long enough that you kind of forget where you are.

Now I’m reminded of this classic Nathan For You moment:

True love will find you in the end

April 21, 2023

This Tiny Desk Concert performance by Daniel Johnston from 2012 really moved me, particularly the fourth and final song, True Love Will Find You In the End.

It has to do, in part, with the impression that Johnston, at 51, is not particularly well. He would die seven years later of a heart attack. He’s singing about how he feels like a mummy, or Dracula, or Mr. Hyde, or a ghost. But he’s not alone up there. He has a friend and an audience that loves him. When he sings about optimism it feels hard-earned and true.

World Chess Championship 2023

April 7, 2023

The World Chess Championship, a head-to-head battle between Ding Liren and Ian Nepomniachtchi, starts this Sunday.

This event happens every two years, and decides who will be the new world chess champion. In the off year, there’s another event called the Candidates Tournament, which decides who will challenge the world champ next time.

Here’s a great preview of the two players by Ben Tippett in Defector: https://defector.com/the-world-chess-championship-begins-on-the-edge-of-the-unknown

If you’re the kind of person who likes being in control, the good news is that you’re responsible for exactly half of what happens on a chess board, but the bad news is that your opponent (who is trying to beat you) is responsible for the other half. You have some control over where you want to steer a game, but ultimately you’re in the boat with your opponent, and you both get the opportunity to row.

I’ll probably catch some of the games live, but I know I’ll be watching the GothamChess recaps after.

I’ve gotten into playing chess and watching chess content in the ~1.5 years since the last world chess championship. In fact it was Tippett’s piece on Defector that caught my attention. That led to watching the GothamChess recaps, including this wildly entertaining summary of this notable game in the match:

As with any niche, there’s a whole ecosystem of personalities, not just this one guy. Here are a few of the popular chess content creators I enjoy following:

  • GM Daniel Naroditsky
    • On YouTube he makes educational videos where he plays lower-rated players, beating them very easily, and explaining every single move in exhaustive detail.
    • On Twitch he grinds speed chess games against top opponents to try and maintain his rating near the very top of the rating charts. He keeps very strange hours, so I will often have him on as I’m falling asleep.
  • WFM Anna Cramling
    • On YouTube she makes educational and entertaining videos that are very accessible and fun. She often plays higher rated players and loses but has a great attitude about it. Both of her parents are grandmasters, and so she will often pull them in, which is quite sweet.
    • She’s also on Twitch although I haven’t caught her stream too many times
  • GM Hikaru Nakamura
    • First, here’s a fun article about him in The New Yorker: The Most Popular Chess Streamer on Twitch
    • On YouTube, he posts tons and tons of content, including videos of him playing against lower rated players and basically stunting on them, much more for entertainment sake than educational sake. But he also posts recaps of his legit tournaments and excerpts from his stream when he’s competing in events like Chess.com’s Titled Tuesday, which he routinely wins.
    • On Twitch where he streams loads and loads of chess
    • On Kick which I guess is some new Twitch competitor that threw a bucket of money at him to also stream there? idk

If you want to play some chess with me, get in touch :)

Joe Camerlengo's New Things

April 2, 2023

Joe Camerlengo, who I’ve previously written about twice before in these pages, has a new EP out (Apple Music, Spotify) and a great interview to promote it.

The subject of these songs is being a first time dad. This quote is beautiful:

I’m more artistically inspired than ever, because I’ve never felt as positive or as strongly about anything as I do being with Ozzy and Courtney. Having that little family is the most incredible environment, and I’ve been creating like crazy.

The highlight for me is the closing track, Life Might Begin.

The whole thing reminds me of this recent post from the popular author John Green, which touches on his experience as an artist whose work was heavily criticized, and what it’s taken for him to continue creating art.

the big lesson from those strange days for me is that if I must choose between being cold to the reality of feeling and being cringe, I always want to be cringe.

Honestly, same. There’s a similar unapologetic sincerity in Camerlengo’s work which I could imagine being offputting, but I encourage you to give it a chance anyway. And, hey, John Green is great too. I’ve read all his books and I’m very much looking forward to the upcoming film adaptation of his novel Turtles All the Way Down, which explores OCD beautifully.

See also: this profile from a few years ago naming Camerlengo the best musician in Columbus, Ohio.

Traffic Altercation

April 2, 2023

This sketch from last night’s SNL made me laugh out loud:

It features host Quinta Brunson from Abbott Elementary and I don’t really want to describe it except to say it’s very funny and features quite a lot of shouting. Enjoy.

It seems like road rage may be in the zeitgeist. I’m very much looking forward to Beef, the new Netflix show starring Steven Yeun and Ali Wong about a traffic altercation that spirals out of control.

This is America

April 2, 2023

When there’s another mass shooting in America my mind often goes to this music video from Donald Glover’s Childish Gambino:

You’ve probably seen it before, but I don’t care, it’s so good. Watch it again.

Taylor Swift - Riptide

March 20, 2023

I’ve always loved this Taylor Swift performance of Riptide from 2014.

The original is quite corny and insincere, IMHO, but the words feel potent in Swift’s voice. In part this is because she didn’t touch any of the pronouns, and doesn’t shy away from lyrics like “I wanna be your left-hand man”, which brings to mind the Gaylor conspiracy theory.

Understanding your homebrew dependencies

March 8, 2023

As a programmer who uses macOS, I greatly appreciate Homebrew, the “Missing Package Manager for macOS”.

I just learned about the brew leaves subcommand and was glad to discover it. Here’s a bit about how and why I’m using it.

This may be neurotic, or it may be some PTSD from when I used Arch Linux for a few years, but I try to upgrade all of my homebrew-managed dependencies regularly.

Here’s how I do it.

First, I tell homebrew to phone home and update its local list of packages, which it can use to tell if any of my locally-installed packages have updates:

$ brew update

Then I ask homebrew to list out which packages have updates available, if any:

$ brew outdated

Then, typically, I’ll upgrade all of them1:

$ brew upgrade

Very often I’ll find that some of my outdated packages have names that I do not recognize. There are only about 30 packages that I explicitly install2, but most of those have dependencies which end up getting installed too, so I end up with way more than 30 packages total – more like 138.

For example, I use vim, and vim has several dependencies that homebrew installs when it installs vim:

$ brew deps vim --tree
vim
├── gettext
├── lua
├── ncurses
├── perl
│   ├── berkeley-db
│   │   └── openssl@1.1
│   │       └── ca-certificates
│   └── gdbm
├── python@3.11
│   ├── mpdecimal
│   ├── openssl@1.1
│   │   └── ca-certificates
│   ├── sqlite
│   │   └── readline
│   └── xz
└── ruby
    ├── libyaml
    ├── openssl@1.1
    │   └── ca-certificates
    └── readline

Wow, look at all of those! So, because I installed vim, I also necessarily installed 15 other packages, and I’ll be updating all of them as time goes on.

When homebrew tells me that, for example, xz is outdated, a few questions enter my mind:

  1. what the heck is that?
  2. ok, it’s surely a dependency of something, but what is it a dependency of?
  3. is it possible that it’s actually not even necessary to have installed any longer? Maybe it was a dependency of something that I later uninstalled, but it just lingered around…

Answering all of those questions is possible, but I didn’t actually know how to answer them until today. Let’s take them one-by-one.

What the heck is that?

To answer this, we can use brew info:

$ brew info xz
==> xz: stable 5.4.1 (bottled)
General-purpose data compression with high compression ratio
https://tukaani.org/xz/
/opt/homebrew/Cellar/xz/5.4.1 (95 files, 1.7MB) *
  Poured from bottle on 2023-01-16 at 04:20:15
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/xz.rb
License: Public Domain and LGPL-2.1-or-later and GPL-2.0-or-later and GPL-3.0-or-later
==> Analytics
install: 456,730 (30 days), 2,613,650 (90 days), 7,814,033 (365 days)
install-on-request: 22,257 (30 days), 150,853 (90 days), 422,948 (365 days)
build-error: 44 (30 days)

Which… sure, whatever. Sounds important.

What is this a dependency of?

This is a slightly tricky thing to answer. As far as I can tell, there’s no command such as brew why xz that could simply answer why is it installed (please get in touch if I’m mistaken).

What we can do is use the brew deps command to describe the relationships between packages, and then search through it to see exactly why it is installed. For me, that prints out 1,580 lines of output, which I’ll share in full behind a collapsible details widget here:

Full output of brew deps --full-name --installed --tree (click to expand) 

aom
├── jpeg-xl
│   ├── brotli
│   ├── giflib
│   ├── highway
│   ├── imath
│   ├── jpeg-turbo
│   ├── libpng
│   ├── little-cms2
│   │   ├── jpeg-turbo
│   │   └── libtiff
│   │       ├── jpeg-turbo
│   │       └── zstd
│   │           ├── lz4
│   │           └── xz
│   ├── openexr
│   │   └── imath
│   └── webp
│       ├── giflib
│       ├── jpeg-turbo
│       ├── libpng
│       └── libtiff
│           ├── jpeg-turbo
│           └── zstd
│               ├── lz4
│               └── xz
└── libvmaf

autoconf
└── m4

bash

bat

bdw-gc

berkeley-db
└── openssl@1.1
    └── ca-certificates

indirect/tap/bpb

brotli

ca-certificates

cairo
├── fontconfig
│   └── freetype
│       └── libpng
├── freetype
│   └── libpng
├── glib
│   ├── pcre2
│   └── gettext
├── libpng
├── libx11
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   └── xorgproto
├── libxcb
│   ├── libxau
│   │   └── xorgproto
│   └── libxdmcp
│       └── xorgproto
├── libxext
│   ├── libx11
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   └── xorgproto
│   └── xorgproto
├── libxrender
│   ├── libx11
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   └── xorgproto
│   └── xorgproto
├── lzo
└── pixman

cloc

ctags

emacs
├── gnutls
│   ├── ca-certificates
│   ├── gmp
│   ├── libidn2
│   │   ├── libunistring
│   │   └── gettext
│   ├── libtasn1
│   ├── libunistring
│   ├── nettle
│   │   └── gmp
│   ├── p11-kit
│   │   ├── ca-certificates
│   │   └── libtasn1
│   └── unbound
│       ├── libevent
│       │   └── openssl@1.1
│       │       └── ca-certificates
│       ├── libnghttp2
│       └── openssl@1.1
│           └── ca-certificates
└── jansson

exa
└── libgit2
    └── libssh2
        └── openssl@1.1
            └── ca-certificates

fd

fnm

fontconfig
└── freetype
    └── libpng

freetype
└── libpng

fribidi

gd
├── fontconfig
│   └── freetype
│       └── libpng
├── freetype
│   └── libpng
├── jpeg-turbo
├── libavif
│   ├── aom
│   │   ├── jpeg-xl
│   │   │   ├── brotli
│   │   │   ├── giflib
│   │   │   ├── highway
│   │   │   ├── imath
│   │   │   ├── jpeg-turbo
│   │   │   ├── libpng
│   │   │   ├── little-cms2
│   │   │   │   ├── jpeg-turbo
│   │   │   │   └── libtiff
│   │   │   │       ├── jpeg-turbo
│   │   │   │       └── zstd
│   │   │   │           ├── lz4
│   │   │   │           └── xz
│   │   │   ├── openexr
│   │   │   │   └── imath
│   │   │   └── webp
│   │   │       ├── giflib
│   │   │       ├── jpeg-turbo
│   │   │       ├── libpng
│   │   │       └── libtiff
│   │   │           ├── jpeg-turbo
│   │   │           └── zstd
│   │   │               ├── lz4
│   │   │               └── xz
│   │   └── libvmaf
│   ├── jpeg-turbo
│   └── libpng
├── libpng
├── libtiff
│   ├── jpeg-turbo
│   └── zstd
│       ├── lz4
│       └── xz
└── webp
    ├── giflib
    ├── jpeg-turbo
    ├── libpng
    └── libtiff
        ├── jpeg-turbo
        └── zstd
            ├── lz4
            └── xz

gdbm

gdk-pixbuf
├── glib
│   ├── pcre2
│   └── gettext
├── jpeg-turbo
├── libpng
└── libtiff
    ├── jpeg-turbo
    └── zstd
        ├── lz4
        └── xz

gettext

gh

ghostscript
├── fontconfig
│   └── freetype
│       └── libpng
├── freetype
│   └── libpng
├── jbig2dec
├── jpeg-turbo
├── libidn
├── libpng
├── libtiff
│   ├── jpeg-turbo
│   └── zstd
│       ├── lz4
│       └── xz
├── little-cms2
│   ├── jpeg-turbo
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
└── openjpeg
    ├── libpng
    ├── libtiff
    │   ├── jpeg-turbo
    │   └── zstd
    │       ├── lz4
    │       └── xz
    └── little-cms2
        ├── jpeg-turbo
        └── libtiff
            ├── jpeg-turbo
            └── zstd
                ├── lz4
                └── xz

giflib

git
├── gettext
└── pcre2

git-delta

glib
├── pcre2
└── gettext

gmp

gnutls
├── ca-certificates
├── gmp
├── libidn2
│   ├── libunistring
│   └── gettext
├── libtasn1
├── libunistring
├── nettle
│   └── gmp
├── p11-kit
│   ├── ca-certificates
│   └── libtasn1
└── unbound
    ├── libevent
    │   └── openssl@1.1
    │       └── ca-certificates
    ├── libnghttp2
    └── openssl@1.1
        └── ca-certificates

graphite2

graphviz
├── gd
│   ├── fontconfig
│   │   └── freetype
│   │       └── libpng
│   ├── freetype
│   │   └── libpng
│   ├── jpeg-turbo
│   ├── libavif
│   │   ├── aom
│   │   │   ├── jpeg-xl
│   │   │   │   ├── brotli
│   │   │   │   ├── giflib
│   │   │   │   ├── highway
│   │   │   │   ├── imath
│   │   │   │   ├── jpeg-turbo
│   │   │   │   ├── libpng
│   │   │   │   ├── little-cms2
│   │   │   │   │   ├── jpeg-turbo
│   │   │   │   │   └── libtiff
│   │   │   │   │       ├── jpeg-turbo
│   │   │   │   │       └── zstd
│   │   │   │   │           ├── lz4
│   │   │   │   │           └── xz
│   │   │   │   ├── openexr
│   │   │   │   │   └── imath
│   │   │   │   └── webp
│   │   │   │       ├── giflib
│   │   │   │       ├── jpeg-turbo
│   │   │   │       ├── libpng
│   │   │   │       └── libtiff
│   │   │   │           ├── jpeg-turbo
│   │   │   │           └── zstd
│   │   │   │               ├── lz4
│   │   │   │               └── xz
│   │   │   └── libvmaf
│   │   ├── jpeg-turbo
│   │   └── libpng
│   ├── libpng
│   ├── libtiff
│   │   ├── jpeg-turbo
│   │   └── zstd
│   │       ├── lz4
│   │       └── xz
│   └── webp
│       ├── giflib
│       ├── jpeg-turbo
│       ├── libpng
│       └── libtiff
│           ├── jpeg-turbo
│           └── zstd
│               ├── lz4
│               └── xz
├── gts
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   ├── netpbm
│   │   ├── jasper
│   │   │   └── jpeg-turbo
│   │   ├── jpeg-turbo
│   │   ├── libpng
│   │   └── libtiff
│   │       ├── jpeg-turbo
│   │       └── zstd
│   │           ├── lz4
│   │           └── xz
│   └── gettext
├── libpng
├── librsvg
│   ├── cairo
│   │   ├── fontconfig
│   │   │   └── freetype
│   │   │       └── libpng
│   │   ├── freetype
│   │   │   └── libpng
│   │   ├── glib
│   │   │   ├── pcre2
│   │   │   └── gettext
│   │   ├── libpng
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   ├── libxext
│   │   │   ├── libx11
│   │   │   │   ├── libxcb
│   │   │   │   │   ├── libxau
│   │   │   │   │   │   └── xorgproto
│   │   │   │   │   └── libxdmcp
│   │   │   │   │       └── xorgproto
│   │   │   │   └── xorgproto
│   │   │   └── xorgproto
│   │   ├── libxrender
│   │   │   ├── libx11
│   │   │   │   ├── libxcb
│   │   │   │   │   ├── libxau
│   │   │   │   │   │   └── xorgproto
│   │   │   │   │   └── libxdmcp
│   │   │   │   │       └── xorgproto
│   │   │   │   └── xorgproto
│   │   │   └── xorgproto
│   │   ├── lzo
│   │   └── pixman
│   ├── gdk-pixbuf
│   │   ├── glib
│   │   │   ├── pcre2
│   │   │   └── gettext
│   │   ├── jpeg-turbo
│   │   ├── libpng
│   │   └── libtiff
│   │       ├── jpeg-turbo
│   │       └── zstd
│   │           ├── lz4
│   │           └── xz
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   └── pango
│       ├── cairo
│       │   ├── fontconfig
│       │   │   └── freetype
│       │   │       └── libpng
│       │   ├── freetype
│       │   │   └── libpng
│       │   ├── glib
│       │   │   ├── pcre2
│       │   │   └── gettext
│       │   ├── libpng
│       │   ├── libx11
│       │   │   ├── libxcb
│       │   │   │   ├── libxau
│       │   │   │   │   └── xorgproto
│       │   │   │   └── libxdmcp
│       │   │   │       └── xorgproto
│       │   │   └── xorgproto
│       │   ├── libxcb
│       │   │   ├── libxau
│       │   │   │   └── xorgproto
│       │   │   └── libxdmcp
│       │   │       └── xorgproto
│       │   ├── libxext
│       │   │   ├── libx11
│       │   │   │   ├── libxcb
│       │   │   │   │   ├── libxau
│       │   │   │   │   │   └── xorgproto
│       │   │   │   │   └── libxdmcp
│       │   │   │   │       └── xorgproto
│       │   │   │   └── xorgproto
│       │   │   └── xorgproto
│       │   ├── libxrender
│       │   │   ├── libx11
│       │   │   │   ├── libxcb
│       │   │   │   │   ├── libxau
│       │   │   │   │   │   └── xorgproto
│       │   │   │   │   └── libxdmcp
│       │   │   │   │       └── xorgproto
│       │   │   │   └── xorgproto
│       │   │   └── xorgproto
│       │   ├── lzo
│       │   └── pixman
│       ├── fontconfig
│       │   └── freetype
│       │       └── libpng
│       ├── freetype
│       │   └── libpng
│       ├── fribidi
│       ├── glib
│       │   ├── pcre2
│       │   └── gettext
│       └── harfbuzz
│           ├── cairo
│           │   ├── fontconfig
│           │   │   └── freetype
│           │   │       └── libpng
│           │   ├── freetype
│           │   │   └── libpng
│           │   ├── glib
│           │   │   ├── pcre2
│           │   │   └── gettext
│           │   ├── libpng
│           │   ├── libx11
│           │   │   ├── libxcb
│           │   │   │   ├── libxau
│           │   │   │   │   └── xorgproto
│           │   │   │   └── libxdmcp
│           │   │   │       └── xorgproto
│           │   │   └── xorgproto
│           │   ├── libxcb
│           │   │   ├── libxau
│           │   │   │   └── xorgproto
│           │   │   └── libxdmcp
│           │   │       └── xorgproto
│           │   ├── libxext
│           │   │   ├── libx11
│           │   │   │   ├── libxcb
│           │   │   │   │   ├── libxau
│           │   │   │   │   │   └── xorgproto
│           │   │   │   │   └── libxdmcp
│           │   │   │   │       └── xorgproto
│           │   │   │   └── xorgproto
│           │   │   └── xorgproto
│           │   ├── libxrender
│           │   │   ├── libx11
│           │   │   │   ├── libxcb
│           │   │   │   │   ├── libxau
│           │   │   │   │   │   └── xorgproto
│           │   │   │   │   └── libxdmcp
│           │   │   │   │       └── xorgproto
│           │   │   │   └── xorgproto
│           │   │   └── xorgproto
│           │   ├── lzo
│           │   └── pixman
│           ├── freetype
│           │   └── libpng
│           ├── glib
│           │   ├── pcre2
│           │   └── gettext
│           ├── graphite2
│           └── icu4c
├── libtool
│   └── m4
└── pango
    ├── cairo
    │   ├── fontconfig
    │   │   └── freetype
    │   │       └── libpng
    │   ├── freetype
    │   │   └── libpng
    │   ├── glib
    │   │   ├── pcre2
    │   │   └── gettext
    │   ├── libpng
    │   ├── libx11
    │   │   ├── libxcb
    │   │   │   ├── libxau
    │   │   │   │   └── xorgproto
    │   │   │   └── libxdmcp
    │   │   │       └── xorgproto
    │   │   └── xorgproto
    │   ├── libxcb
    │   │   ├── libxau
    │   │   │   └── xorgproto
    │   │   └── libxdmcp
    │   │       └── xorgproto
    │   ├── libxext
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── libxrender
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── lzo
    │   └── pixman
    ├── fontconfig
    │   └── freetype
    │       └── libpng
    ├── freetype
    │   └── libpng
    ├── fribidi
    ├── glib
    │   ├── pcre2
    │   └── gettext
    └── harfbuzz
        ├── cairo
        │   ├── fontconfig
        │   │   └── freetype
        │   │       └── libpng
        │   ├── freetype
        │   │   └── libpng
        │   ├── glib
        │   │   ├── pcre2
        │   │   └── gettext
        │   ├── libpng
        │   ├── libx11
        │   │   ├── libxcb
        │   │   │   ├── libxau
        │   │   │   │   └── xorgproto
        │   │   │   └── libxdmcp
        │   │   │       └── xorgproto
        │   │   └── xorgproto
        │   ├── libxcb
        │   │   ├── libxau
        │   │   │   └── xorgproto
        │   │   └── libxdmcp
        │   │       └── xorgproto
        │   ├── libxext
        │   │   ├── libx11
        │   │   │   ├── libxcb
        │   │   │   │   ├── libxau
        │   │   │   │   │   └── xorgproto
        │   │   │   │   └── libxdmcp
        │   │   │   │       └── xorgproto
        │   │   │   └── xorgproto
        │   │   └── xorgproto
        │   ├── libxrender
        │   │   ├── libx11
        │   │   │   ├── libxcb
        │   │   │   │   ├── libxau
        │   │   │   │   │   └── xorgproto
        │   │   │   │   └── libxdmcp
        │   │   │   │       └── xorgproto
        │   │   │   └── xorgproto
        │   │   └── xorgproto
        │   ├── lzo
        │   └── pixman
        ├── freetype
        │   └── libpng
        ├── glib
        │   ├── pcre2
        │   └── gettext
        ├── graphite2
        └── icu4c

gts
├── glib
│   ├── pcre2
│   └── gettext
├── netpbm
│   ├── jasper
│   │   └── jpeg-turbo
│   ├── jpeg-turbo
│   ├── libpng
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
└── gettext

guile
├── bdw-gc
├── gmp
├── libtool
│   └── m4
├── libunistring
├── pkg-config
└── readline

harfbuzz
├── cairo
│   ├── fontconfig
│   │   └── freetype
│   │       └── libpng
│   ├── freetype
│   │   └── libpng
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   ├── libpng
│   ├── libx11
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   └── xorgproto
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   ├── libxext
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── libxrender
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── lzo
│   └── pixman
├── freetype
│   └── libpng
├── glib
│   ├── pcre2
│   └── gettext
├── graphite2
└── icu4c

heroku/brew/heroku
└── heroku/brew/heroku-node

heroku/brew/heroku-node

highway

htop
└── ncurses

icu4c

imagemagick
├── freetype
│   └── libpng
├── ghostscript
│   ├── fontconfig
│   │   └── freetype
│   │       └── libpng
│   ├── freetype
│   │   └── libpng
│   ├── jbig2dec
│   ├── jpeg-turbo
│   ├── libidn
│   ├── libpng
│   ├── libtiff
│   │   ├── jpeg-turbo
│   │   └── zstd
│   │       ├── lz4
│   │       └── xz
│   ├── little-cms2
│   │   ├── jpeg-turbo
│   │   └── libtiff
│   │       ├── jpeg-turbo
│   │       └── zstd
│   │           ├── lz4
│   │           └── xz
│   └── openjpeg
│       ├── libpng
│       ├── libtiff
│       │   ├── jpeg-turbo
│       │   └── zstd
│       │       ├── lz4
│       │       └── xz
│       └── little-cms2
│           ├── jpeg-turbo
│           └── libtiff
│               ├── jpeg-turbo
│               └── zstd
│                   ├── lz4
│                   └── xz
├── jpeg-turbo
├── libheif
│   ├── aom
│   │   ├── jpeg-xl
│   │   │   ├── brotli
│   │   │   ├── giflib
│   │   │   ├── highway
│   │   │   ├── imath
│   │   │   ├── jpeg-turbo
│   │   │   ├── libpng
│   │   │   ├── little-cms2
│   │   │   │   ├── jpeg-turbo
│   │   │   │   └── libtiff
│   │   │   │       ├── jpeg-turbo
│   │   │   │       └── zstd
│   │   │   │           ├── lz4
│   │   │   │           └── xz
│   │   │   ├── openexr
│   │   │   │   └── imath
│   │   │   └── webp
│   │   │       ├── giflib
│   │   │       ├── jpeg-turbo
│   │   │       ├── libpng
│   │   │       └── libtiff
│   │   │           ├── jpeg-turbo
│   │   │           └── zstd
│   │   │               ├── lz4
│   │   │               └── xz
│   │   └── libvmaf
│   ├── jpeg-turbo
│   ├── libde265
│   ├── libpng
│   ├── shared-mime-info
│   │   └── glib
│   │       ├── pcre2
│   │       └── gettext
│   └── x265
├── liblqr
│   └── glib
│       ├── pcre2
│       └── gettext
├── libpng
├── libraw
│   ├── jasper
│   │   └── jpeg-turbo
│   ├── jpeg-turbo
│   ├── little-cms2
│   │   ├── jpeg-turbo
│   │   └── libtiff
│   │       ├── jpeg-turbo
│   │       └── zstd
│   │           ├── lz4
│   │           └── xz
│   └── libomp
├── libtiff
│   ├── jpeg-turbo
│   └── zstd
│       ├── lz4
│       └── xz
├── libtool
│   └── m4
├── little-cms2
│   ├── jpeg-turbo
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
├── openexr
│   └── imath
├── openjpeg
│   ├── libpng
│   ├── libtiff
│   │   ├── jpeg-turbo
│   │   └── zstd
│   │       ├── lz4
│   │       └── xz
│   └── little-cms2
│       ├── jpeg-turbo
│       └── libtiff
│           ├── jpeg-turbo
│           └── zstd
│               ├── lz4
│               └── xz
├── webp
│   ├── giflib
│   ├── jpeg-turbo
│   ├── libpng
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
├── xz
└── libomp

imath

jansson

jasper
└── jpeg-turbo

jbig2dec

jpeg-turbo

jpeg-xl
├── brotli
├── giflib
├── highway
├── imath
├── jpeg-turbo
├── libpng
├── little-cms2
│   ├── jpeg-turbo
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
├── openexr
│   └── imath
└── webp
    ├── giflib
    ├── jpeg-turbo
    ├── libpng
    └── libtiff
        ├── jpeg-turbo
        └── zstd
            ├── lz4
            └── xz

jq
└── oniguruma

krb5
└── openssl@1.1
    └── ca-certificates

libavif
├── aom
│   ├── jpeg-xl
│   │   ├── brotli
│   │   ├── giflib
│   │   ├── highway
│   │   ├── imath
│   │   ├── jpeg-turbo
│   │   ├── libpng
│   │   ├── little-cms2
│   │   │   ├── jpeg-turbo
│   │   │   └── libtiff
│   │   │       ├── jpeg-turbo
│   │   │       └── zstd
│   │   │           ├── lz4
│   │   │           └── xz
│   │   ├── openexr
│   │   │   └── imath
│   │   └── webp
│   │       ├── giflib
│   │       ├── jpeg-turbo
│   │       ├── libpng
│   │       └── libtiff
│   │           ├── jpeg-turbo
│   │           └── zstd
│   │               ├── lz4
│   │               └── xz
│   └── libvmaf
├── jpeg-turbo
└── libpng

libde265

libevent
└── openssl@1.1
    └── ca-certificates

libheif
├── aom
│   ├── jpeg-xl
│   │   ├── brotli
│   │   ├── giflib
│   │   ├── highway
│   │   ├── imath
│   │   ├── jpeg-turbo
│   │   ├── libpng
│   │   ├── little-cms2
│   │   │   ├── jpeg-turbo
│   │   │   └── libtiff
│   │   │       ├── jpeg-turbo
│   │   │       └── zstd
│   │   │           ├── lz4
│   │   │           └── xz
│   │   ├── openexr
│   │   │   └── imath
│   │   └── webp
│   │       ├── giflib
│   │       ├── jpeg-turbo
│   │       ├── libpng
│   │       └── libtiff
│   │           ├── jpeg-turbo
│   │           └── zstd
│   │               ├── lz4
│   │               └── xz
│   └── libvmaf
├── jpeg-turbo
├── libde265
├── libpng
├── shared-mime-info
│   └── glib
│       ├── pcre2
│       └── gettext
└── x265

libidn

libidn2
├── libunistring
└── gettext

liblqr
└── glib
    ├── pcre2
    └── gettext

libnghttp2

libomp

libpng

libraw
├── jasper
│   └── jpeg-turbo
├── jpeg-turbo
├── little-cms2
│   ├── jpeg-turbo
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
└── libomp

librsvg
├── cairo
│   ├── fontconfig
│   │   └── freetype
│   │       └── libpng
│   ├── freetype
│   │   └── libpng
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   ├── libpng
│   ├── libx11
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   └── xorgproto
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   ├── libxext
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── libxrender
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── lzo
│   └── pixman
├── gdk-pixbuf
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   ├── jpeg-turbo
│   ├── libpng
│   └── libtiff
│       ├── jpeg-turbo
│       └── zstd
│           ├── lz4
│           └── xz
├── glib
│   ├── pcre2
│   └── gettext
└── pango
    ├── cairo
    │   ├── fontconfig
    │   │   └── freetype
    │   │       └── libpng
    │   ├── freetype
    │   │   └── libpng
    │   ├── glib
    │   │   ├── pcre2
    │   │   └── gettext
    │   ├── libpng
    │   ├── libx11
    │   │   ├── libxcb
    │   │   │   ├── libxau
    │   │   │   │   └── xorgproto
    │   │   │   └── libxdmcp
    │   │   │       └── xorgproto
    │   │   └── xorgproto
    │   ├── libxcb
    │   │   ├── libxau
    │   │   │   └── xorgproto
    │   │   └── libxdmcp
    │   │       └── xorgproto
    │   ├── libxext
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── libxrender
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── lzo
    │   └── pixman
    ├── fontconfig
    │   └── freetype
    │       └── libpng
    ├── freetype
    │   └── libpng
    ├── fribidi
    ├── glib
    │   ├── pcre2
    │   └── gettext
    └── harfbuzz
        ├── cairo
        │   ├── fontconfig
        │   │   └── freetype
        │   │       └── libpng
        │   ├── freetype
        │   │   └── libpng
        │   ├── glib
        │   │   ├── pcre2
        │   │   └── gettext
        │   ├── libpng
        │   ├── libx11
        │   │   ├── libxcb
        │   │   │   ├── libxau
        │   │   │   │   └── xorgproto
        │   │   │   └── libxdmcp
        │   │   │       └── xorgproto
        │   │   └── xorgproto
        │   ├── libxcb
        │   │   ├── libxau
        │   │   │   └── xorgproto
        │   │   └── libxdmcp
        │   │       └── xorgproto
        │   ├── libxext
        │   │   ├── libx11
        │   │   │   ├── libxcb
        │   │   │   │   ├── libxau
        │   │   │   │   │   └── xorgproto
        │   │   │   │   └── libxdmcp
        │   │   │   │       └── xorgproto
        │   │   │   └── xorgproto
        │   │   └── xorgproto
        │   ├── libxrender
        │   │   ├── libx11
        │   │   │   ├── libxcb
        │   │   │   │   ├── libxau
        │   │   │   │   │   └── xorgproto
        │   │   │   │   └── libxdmcp
        │   │   │   │       └── xorgproto
        │   │   │   └── xorgproto
        │   │   └── xorgproto
        │   ├── lzo
        │   └── pixman
        ├── freetype
        │   └── libpng
        ├── glib
        │   ├── pcre2
        │   └── gettext
        ├── graphite2
        └── icu4c

libtasn1

libtermkey
└── unibilium

libtiff
├── jpeg-turbo
└── zstd
    ├── lz4
    └── xz

libtool
└── m4

libunistring

libuv

libvmaf

libvterm

libx11
├── libxcb
│   ├── libxau
│   │   └── xorgproto
│   └── libxdmcp
│       └── xorgproto
└── xorgproto

libxau
└── xorgproto

libxcb
├── libxau
│   └── xorgproto
└── libxdmcp
    └── xorgproto

libxdmcp
└── xorgproto

libxext
├── libx11
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   └── xorgproto
└── xorgproto

libxrender
├── libx11
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   └── xorgproto
└── xorgproto

libyaml

little-cms2
├── jpeg-turbo
└── libtiff
    ├── jpeg-turbo
    └── zstd
        ├── lz4
        └── xz

lua

luajit

luv
└── libuv

lz4

lzo

m4

mpdecimal

msgpack

ncdu
└── ncurses

ncurses

neovim
├── gettext
├── libtermkey
│   └── unibilium
├── libuv
├── libvterm
├── luajit
├── luv
│   └── libuv
├── msgpack
├── tree-sitter
└── unibilium

netpbm
├── jasper
│   └── jpeg-turbo
├── jpeg-turbo
├── libpng
└── libtiff
    ├── jpeg-turbo
    └── zstd
        ├── lz4
        └── xz

nettle
└── gmp

oniguruma

openexr
└── imath

openjpeg
├── libpng
├── libtiff
│   ├── jpeg-turbo
│   └── zstd
│       ├── lz4
│       └── xz
└── little-cms2
    ├── jpeg-turbo
    └── libtiff
        ├── jpeg-turbo
        └── zstd
            ├── lz4
            └── xz

openssl@1.1
└── ca-certificates

openssl@3
└── ca-certificates

p11-kit
├── ca-certificates
└── libtasn1

pango
├── cairo
│   ├── fontconfig
│   │   └── freetype
│   │       └── libpng
│   ├── freetype
│   │   └── libpng
│   ├── glib
│   │   ├── pcre2
│   │   └── gettext
│   ├── libpng
│   ├── libx11
│   │   ├── libxcb
│   │   │   ├── libxau
│   │   │   │   └── xorgproto
│   │   │   └── libxdmcp
│   │   │       └── xorgproto
│   │   └── xorgproto
│   ├── libxcb
│   │   ├── libxau
│   │   │   └── xorgproto
│   │   └── libxdmcp
│   │       └── xorgproto
│   ├── libxext
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── libxrender
│   │   ├── libx11
│   │   │   ├── libxcb
│   │   │   │   ├── libxau
│   │   │   │   │   └── xorgproto
│   │   │   │   └── libxdmcp
│   │   │   │       └── xorgproto
│   │   │   └── xorgproto
│   │   └── xorgproto
│   ├── lzo
│   └── pixman
├── fontconfig
│   └── freetype
│       └── libpng
├── freetype
│   └── libpng
├── fribidi
├── glib
│   ├── pcre2
│   └── gettext
└── harfbuzz
    ├── cairo
    │   ├── fontconfig
    │   │   └── freetype
    │   │       └── libpng
    │   ├── freetype
    │   │   └── libpng
    │   ├── glib
    │   │   ├── pcre2
    │   │   └── gettext
    │   ├── libpng
    │   ├── libx11
    │   │   ├── libxcb
    │   │   │   ├── libxau
    │   │   │   │   └── xorgproto
    │   │   │   └── libxdmcp
    │   │   │       └── xorgproto
    │   │   └── xorgproto
    │   ├── libxcb
    │   │   ├── libxau
    │   │   │   └── xorgproto
    │   │   └── libxdmcp
    │   │       └── xorgproto
    │   ├── libxext
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── libxrender
    │   │   ├── libx11
    │   │   │   ├── libxcb
    │   │   │   │   ├── libxau
    │   │   │   │   │   └── xorgproto
    │   │   │   │   └── libxdmcp
    │   │   │   │       └── xorgproto
    │   │   │   └── xorgproto
    │   │   └── xorgproto
    │   ├── lzo
    │   └── pixman
    ├── freetype
    │   └── libpng
    ├── glib
    │   ├── pcre2
    │   └── gettext
    ├── graphite2
    └── icu4c

pcre

pcre2

perl
├── berkeley-db
│   └── openssl@1.1
│       └── ca-certificates
└── gdbm

pixman

pkg-config

postgresql@14
├── icu4c
├── krb5
│   └── openssl@1.1
│       └── ca-certificates
├── lz4
├── openssl@1.1
│   └── ca-certificates
└── readline

pure
└── zsh-async

python@3.11
├── mpdecimal
├── openssl@1.1
│   └── ca-certificates
├── sqlite
│   └── readline
└── xz

rbenv
└── ruby-build
    ├── autoconf
    │   └── m4
    ├── pkg-config
    └── readline

rcm

readline

redis
└── openssl@1.1
    └── ca-certificates

ripgrep
└── pcre2

ruby
├── libyaml
├── openssl@1.1
│   └── ca-certificates
└── readline

ruby-build
├── autoconf
│   └── m4
├── pkg-config
└── readline

rust
├── openssl@1.1
│   └── ca-certificates
└── pkg-config

shared-mime-info
└── glib
    ├── pcre2
    └── gettext

sl

sqlite
└── readline

terminal-notifier

tig
├── ncurses
├── pcre2
└── readline

tmux
├── libevent
│   └── openssl@1.1
│       └── ca-certificates
├── ncurses
└── utf8proc

tree

tree-sitter

unbound
├── libevent
│   └── openssl@1.1
│       └── ca-certificates
├── libnghttp2
└── openssl@1.1
    └── ca-certificates

unibilium

utf8proc

vim
├── gettext
├── lua
├── ncurses
├── perl
│   ├── berkeley-db
│   │   └── openssl@1.1
│   │       └── ca-certificates
│   └── gdbm
├── python@3.11
│   ├── mpdecimal
│   ├── openssl@1.1
│   │   └── ca-certificates
│   ├── sqlite
│   │   └── readline
│   └── xz
└── ruby
    ├── libyaml
    ├── openssl@1.1
    │   └── ca-certificates
    └── readline

watch
└── ncurses

webp
├── giflib
├── jpeg-turbo
├── libpng
└── libtiff
    ├── jpeg-turbo
    └── zstd
        ├── lz4
        └── xz

wget
├── libidn2
│   ├── libunistring
│   └── gettext
└── openssl@3
    └── ca-certificates

x265

xorgproto

xz

yarn

youtube-dl
└── python@3.11
    ├── mpdecimal
    ├── openssl@1.1
    │   └── ca-certificates
    ├── sqlite
    │   └── readline
    └── xz

zsh
├── ncurses
└── pcre

zsh-async

zsh-syntax-highlighting

zstd
├── lz4
└── xz

As we can see… tons of things depend on xz.

This output is slightly overwhelming, but if you want to be even more overwhelmed, you can run brew deps --full-name --installed --graph to produce a visual graph representation, which I’ll present to you here:

graph of brew dependencies

You can click on it to see it in more detail.

Maybe I’m not much of a visual learner, but I’ll take the plain text representation any day.

How do I know if I even need this package any longer?

One easy way to figure out if you need a package any longer is to just try uninstalling it and seeing what happens:

$ brew uninstall xz
==> Downloading https://formulae.brew.sh/api/cask.jws.json
######################################################################## 100.0%
Error: Refusing to uninstall /opt/homebrew/Cellar/xz/5.4.1
because it is required by aom, gd, gdk-pixbuf, ghostscript, graphviz, gts, imagemagick, jpeg-xl, libavif, libheif, libraw, librsvg, libtiff, little-cms2, netpbm, openjpeg, python@3.11, vim, webp, youtube-dl and zstd, which are currently installed.
You can override this and force removal with:
  brew uninstall --ignore-dependencies xz

As you can see, homebrew refuses to uninstall it because it’s a dependency of a bunch of stuff. So, I guess, I do need this one.

It would be tedious to do this one-by-one, going through all ~100 or so of the packages I have installed that I don’t recognize the name of, just to free up some space on my hard drive.

Thankfully, it turns out that homebrew has another command, brew leaves, which will solve this problem.

If I run brew list, homebrew prints out 138 packages, many with names I don’t recognize.

If I run brew leaves instead, it prints out 38 packages, most of which I recall asking homebrew to install.

Let’s learn more about this subcommand:

$ brew leaves --help
Usage: brew leaves [--installed-on-request] [--installed-as-dependency]

List installed formulae that are not dependencies of another installed formula.

  -r, --installed-on-request       Only list leaves that were manually
                                   installed.
  -p, --installed-as-dependency    Only list leaves that were installed as
                                   dependencies.
  -d, --debug                      Display any debugging information.
  -q, --quiet                      Make some output more quiet.
  -v, --verbose                    Make some output more verbose.
  -h, --help                       Show this message.

In other words, running brew leaves will print out all of the things that can be uninstalled, because nothing depends on them. In my case, that includes vim, but not xz.

So, if there’s anything in the brew leaves output that you don’t think you need, you can probably safely uninstall it.

There are two flags there that are particularly handy: --installed-on-request and --installed-as-dependency, which filter the output based on why exactly that package is installed on your system.

If you run brew leaves --installed-as-dependency, it will print out all of the things that:

  1. were installed as a dependency of something else
  2. but are no longer a dependency of anything

That sounds eminently uninstallable if anything does.

Note that when you uninstall a package, homebrew does not uninstall that package’s dependencies. That means that many of that package’s dependencies, which were previously not uninstallable become uninstallable. In other words, they become leaves.

So, for example, if I run brew uninstall imagemagick and then check on my leaves, here’s what I see:

$ brew leaves --installed-as-dependency
ghostscript
libheif
liblqr
libraw

I still have ghostscript, libheif, liblqr, and libraw hanging around, and I can use this command to identify that they are not actually needed anymore and continue trimming my hedge.

  1. If homebrew wants to upgrade vim, I’ll usually quit any running vim processes, because it sometimes gets wonky when you upgrade it while it’s already running. ↩

  2. Which I can see spelled out in my Brewfile ↩