Apple container formula breaks Local Network permissions after upgrades

[aravind-n]

brew config AND brew doctor output OR brew gist-logs <formula> link

> brew config
HOMEBREW_VERSION: 7.0.4-47-g32b5f52
ORIGIN: https://github.com/Homebrew/brew
HEAD: 32b5f52a42555d8004f9273a716baea06971fdcb
Last commit: 6 hours ago
Branch: main
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.7/bin/ruby
CPU: 18-core 64-bit arm_sotra
Clang: 21.0.0 build 2100
Git: 2.54.0 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.6.2-arm64
CLT: 27.0.0.0.1788430756
Xcode: N/A
Rosetta 2: false



> brew doctor
Your system is ready to brew.

Verification

• My brew doctor output says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.
• My issue is not about a failure to build a formula from source.
• I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.

What were you trying to do (and why)?

I was trying to publish a port from my container so I could test it. That triggered an OS prompt with "Allow “container-runti” to find devices on local networks?". Granting the permission didn't work.

What happened (include all command output)?

I opened system settings and went to privacy > local network. there I saw multiple entries for "container-runtime-linux". If I tried to enable the current installed one, only the first one on the list got enabled (even if I clicked on enabling the last one). Had no idea what was going on here so I put the issue into codex and it looked through my computer. It found something (copy pasting from there)

  /Library/Preferences/com.apple.networkextension.plist

  It referenced these three executables:

  /opt/homebrew/Cellar/container/1.1.0/libexec/container-plugins/container-runtime-linux/bin/container-runtime-linux
  /opt/homebrew/Cellar/container/1.3.1/libexec/container-plugins/container-runtime-linux/bin/container-runtime-linux
  /opt/homebrew/Cellar/container/1.4.1/libexec/container-plugins/container-runtime-linux/bin/container-runtime-linux

  The helper binaries themselves had the code-signing identifier:

  com.apple.container.container-runtime-linux

  However, each Homebrew build was ad-hoc signed, so macOS tracked the executables using changing identities/UUIDs. 
  The concrete evidence of all three stale version paths was in com.apple.networkextension.plist

So basically because the local network panel in preferences is now stuck because I can't give permissions to the latest version and macOS for some reason decided that you can't remove old entries

What did you expect to happen?

It shouldn't be getting mangled I guess? I was expecting the permissions on the latest executable would carry through

Step-by-step reproduction instructions (by running brew commands)

brew install container
brew services start container

# Get the network prompt
container run --detach --rm --name network-test --publish 8080:80 nginx:latest
curl http://127.0.0.1:8080

container stop network-test
brew services stop container

brew update
brew upgrade container
container system start

# Run the same network test again
container run --detach --rm --name network-test --publish 8080:80 nginx:latest
curl http://127.0.0.1:8080


When macOS requests access a second time, deny then go into System Settings > Privacy & Security > Local Network. You should see multiple entries for container-runtime-linux. If you try enabling the permissions for the later ones, it should only enable for the older ones.