CONCEPTS

The Inbox

Packages, Homebrew taps and machine keys that need your decision wait in the Inbox, ~/.tether/inbox.json. The Inbox stays on this machine and never syncs. tether status counts its items, and the dashboard header shows ⚑ Inbox <count>.

Why an item waits

Each item shows one or more reasons, such as "from another machine", "untrusted tap" or "new machine key". The Inbox reasons page lists each reason and what it means.

Tether checks every held item again on each sync. An item leaves the Inbox once no check holds it. For example, its source machine becomes trusted, or its tap becomes trusted. A sync drops items for packages that no machine record lists any more, and for packages that leave this machine's profile.

Review the Inbox

tether packages inbox
tether packages approve npm:typescript
tether packages reject npm:typescript

• tether packages inbox groups items by source machine and reason
• In a terminal, approve and reject show the item and ask. -y does not answer them
• Without a terminal, name the version, tap or key fingerprint you reviewed with --expect, such as --expect 5.6.3
• On the dashboard, open the Security tab. Press a to approve, x to reject, A to approve all safe packages, or M to approve all from the item's machine

In a terminal, tether sync asks "Install these packages?" when items wait. The answers are "Review each", "Install all", "Install all from <machine>" and "Decide later". The daemon does not ask. It sends one notification for each new batch.

Approve many at once

tether packages approve --all --from work-laptop

approve --all lists the packages and asks first. Without a terminal, it needs -y. It is the only command where -y approves Inbox items. It approves exactly the items it listed.

approve --all, "Install all" and A and M on the Security tab leave these items in the Inbox:

• Machine keys
• Packages that OSV lists as malicious
• Packages whose record fails its signature
• Packages without a version or tap to name

Bulk approval does approve packages from machines you do not trust and formulae from untrusted taps. Review the list before you confirm it.

What a decision covers

• An approval covers that version only. For Homebrew, it covers only the tap that the name resolved to. For a machine, it covers only that key
• A rejected version, tap or key is not offered again
• A release with a MAL- advisory cannot be approved
• Approving a package from an untrusted tap does not trust the tap. Approve the tap item, or add the tap to packages.brew.trusted_taps
• Tether refuses a decision when the item changed after you saw it, and shows the item again
• A package whose record fails its signature needs a second question in a terminal. Without a terminal, it needs --expect and --allow-signature-failed