What Watch checks
Homebrew and Docker
New in 1.2.0 Requires Cloak Watch 1.2.0 or later.
What Cloak Watch checks in Homebrew and Docker: redirected downloads, taps from elsewhere, unsigned casks, unknown CLI plugins, saved registry passwords and plain-TCP hosts.
Homebrew and Docker both download and run code with your access, and both can be pointed somewhere else by a line in a config file. Cloak Watch reads their settings, taps, casks and plugins as files and flags what attackers change. It never runs brew or docker: each fix is a command for you to run, or a move to Quarantine you confirm.
Homebrew
Section titled “Homebrew”| Card | Tier | What Watch flags | What to do |
|---|---|---|---|
| BREW-1 “Homebrew settings redirect downloads or turn off its checks” | Review | In a brew.env file or a shell profile: HOMEBREW_*_DOMAIN or *_GIT_REMOTE overrides, HOMEBREW_NO_VERIFY_ATTESTATIONS, HOMEBREW_NO_REQUIRE_TAP_TRUST, HOMEBREW_CURLRC, HOMEBREW_INSTALL_FROM_API_URL and similar |
If your company runs a Homebrew mirror, this is expected: mark it as not a problem. Otherwise remove the line. |
| BREW-2 “Homebrew tap … comes from somewhere else” | Review | A third-party tap whose Git remote isn’t the repository its name says (github.com/<owner>/homebrew-<name>), or whose remote changed since Watch first saw it (“… changed where it comes from”) |
If you didn’t add it with that URL, run brew untap …, then brew tap … to get the real one. |
| BREW-3 | From the pack | A tap or formula an incident pack names | Follow the card’s steps. |
| BREW-4 “… skipped Gatekeeper and isn’t signed” | Review | A cask app with no quarantine flag, so Gatekeeper never checked it, that is unsigned or ad-hoc signed | brew reinstall --cask …, without --no-quarantine. If macOS then refuses to open it, brew uninstall --cask …. |
Watch reads /etc/homebrew/brew.env, Homebrew’s own etc/homebrew/brew.env, ~/.homebrew/brew.env and ~/.config/homebrew/brew.env, your shell profiles, each tap’s Git remote and Homebrew’s tap trust list.
Docker
Section titled “Docker”| Card | Tier | What Watch flags | What to do |
|---|---|---|---|
| DOCK-1 “Docker CLI plugin from an unknown source” | Review | A file named docker-* in ~/.docker/cli-plugins (or another Docker plugin folder) that isn’t a link into Docker Desktop, OrbStack, Rancher Desktop, Podman or Homebrew, and isn’t signed by an identified developer |
See below. |
| DOCK-2 “Docker registry passwords are saved in plain text” | Review | A password or token for a registry saved in ~/.docker/config.json |
Add "credsStore": "osxkeychain" (or "desktop" with Docker Desktop) to the file, run docker logout and docker login so the login moves into the Keychain, then rotate the password. Watch records which registries, never the password. |
| DOCK-3 “Docker pulls from … without TLS” or “Docker talks to … without TLS” | Review | A remote registry in insecure-registries, or a Docker context, daemon host or DOCKER_HOST that uses plain tcp:// to another machine |
Remove the registry from insecure-registries (Docker Desktop › Settings › Docker Engine) and give it a certificate; for a host, use an ssh:// Docker context or a TLS endpoint instead. |
Docker’s own plugins
Section titled “Docker’s own plugins”Docker’s docs have you install some plugins, such as docker-compose and docker-buildx, by hand from their GitHub releases, and those files aren’t Developer ID signed. Watch never offers to quarantine a plugin with one of Docker’s own names. Instead the card asks you to check where it came from:
- For buildx, compose, scout, sbom and scan, compare the file’s SHA-256 (
shasum -a 256 …) with the checksums on the plugin’s GitHub releases page for that version. - For Docker’s other plugin names, check it links into Docker Desktop, and reinstall Docker Desktop if you didn’t put it there yourself.
- If it doesn’t match, delete it and reinstall the plugin from Docker Desktop, Homebrew or Docker’s release page.
A plugin with a name Docker doesn’t use can be moved to Quarantine with Fix it.
Container images
Section titled “Container images”Watch also lists the images in each running container engine and matches them against incident packs. See Container images.