Fixing Zsh Compinit Errors After Accidental Brew Update with Non-Brew User

[jimmcslim]

Output of brew config

brewer@Mac zsh % brew config
HOMEBREW_VERSION: 4.4.8
ORIGIN: https://github.com/Homebrew/brew
HEAD: e78a0adb4f260913fffdc956cc8c20fb54109feb
Last commit: 2 days ago
Branch: stable
Core tap JSON: 27 Nov 21:50 UTC
Core cask tap JSON: 27 Nov 21:51 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 3.3.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.6/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 16.0.0 build 1600
Git: 2.39.5 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.1.1-arm64
CLT: 16.1.0.0.1.1729049160
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Your system is ready to brew.

Description of issue

I have three users on my Mac...

admin: the initial setup account, type Admin
jim: my every day account, type Standard
brewer: the account through which I installed Homebrew, type Admin

So, if I want to install software through brew I su brewer and brew install, brew update, brew upgrade, etc my way to victory.

This has worked just fine for quite a while.

However at some recent point in time, I think I accidentally ran brew update or brew upgrade as my jim user. And ever since then opening my shell as jim has resulted in the dreaded compinit errors...

zsh compinit: insecure directories and files, run compaudit for list.
Ignore insecure directories and files and continue [y] or abort compinit [n]?

If I abort and then later run compaudit, I get...

There are insecure directories and files:
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/share/zsh/site-functions/_bun
/opt/homebrew/share/zsh/site-functions/_deno
/opt/homebrew/share/zsh/site-functions/_gh
/opt/homebrew/share/zsh/site-functions/_google_cloud_sdk
/opt/homebrew/share/zsh/site-functions/_just
/opt/homebrew/share/zsh/site-functions/_k9s
/opt/homebrew/share/zsh/site-functions/_kubectl
/opt/homebrew/share/zsh/site-functions/_kubectx
/opt/homebrew/share/zsh/site-functions/_kubens
/opt/homebrew/share/zsh/site-functions/_lsd
/opt/homebrew/share/zsh/site-functions/_pipx
/opt/homebrew/share/zsh/site-functions/_rclone
/opt/homebrew/share/zsh/site-functions/_ruff
/opt/homebrew/share/zsh/site-functions/_rye
/opt/homebrew/share/zsh/site-functions/_starship
/opt/homebrew/share/zsh/site-functions/_uv
/opt/homebrew/share/zsh/site-functions/_uvx

And looking at permissions of /opt/homebrew/share/zsh...

❯ ls -la
total 0
drwxr-xr-x   3 brewer  admin    96  5 Jul  2023 .
drwxr-xr-x  50 brewer  admin  1600 27 Nov 14:48 ..
drwxr-xr-x  20 brewer  admin   640 28 Nov 07:51 site-functions

They seem reasonable to me. But reading up on zsh and completions it suggests that if completions are not owned by root or the current user, or if they are but they are group or world writable, then this fails the zsh completions security checks. If that is the case... then why haven't I always had this issue with completions?

Does anyone have a reliable way of getting completions to work in my installation scenario?

[ehurrn]

run compaudit | xargs chmod g-w to remove group permissions, should fix your issue

[jimmcslim]

Thanks for the suggestion, but I don't think this will help me since the directories are already not group writeable?

❯ compaudit | xargs ls -ld
There are insecure directories and files:
drwxr-xr-x   3 brewer  admin   96  5 Jul  2023 /opt/homebrew/share/zsh
drwxr-xr-x  20 brewer  admin  640 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions
lrwxr-xr-x   1 brewer  admin   30  5 Jul  2023 /opt/homebrew/share/zsh/site-functions/_brew -> ../../../completions/zsh/_brew
lrwxr-xr-x@  1 brewer  admin   56 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions/_bun -> ../../../Cellar/bun/1.1.42/share/zsh/site-functions/_bun
lrwxr-xr-x@  1 brewer  admin   57 12 Dec 12:20 /opt/homebrew/share/zsh/site-functions/_deno -> ../../../Cellar/deno/2.1.4/share/zsh/site-functions/_deno
lrwxr-xr-x@  1 brewer  admin   56 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions/_gh -> ../../../Cellar/gh/2.64.0_1/share/zsh/site-functions/_gh
lrwxr-xr-x@  1 brewer  admin   83 19 Mar  2024 /opt/homebrew/share/zsh/site-functions/_google_cloud_sdk -> /opt/homebrew/Caskroom/google-cloud-sdk/468.0.0/google-cloud-sdk/completion.zsh.inc
lrwxr-xr-x@  1 brewer  admin   58 11 Dec 19:07 /opt/homebrew/share/zsh/site-functions/_just -> ../../../Cellar/just/1.38.0/share/zsh/site-functions/_just
lrwxr-xr-x@  1 brewer  admin   56 19 Nov 22:34 /opt/homebrew/share/zsh/site-functions/_k9s -> ../../../Cellar/k9s/0.32.7/share/zsh/site-functions/_k9s
lrwxr-xr-x@  1 brewer  admin   71 14 Dec 16:02 /opt/homebrew/share/zsh/site-functions/_kubectl -> ../../../Cellar/kubernetes-cli/1.32.0/share/zsh/site-functions/_kubectl
lrwxr-xr-x@  1 brewer  admin   63 25 Sep  2023 /opt/homebrew/share/zsh/site-functions/_kubectx -> ../../../Cellar/kubectx/0.9.5/share/zsh/site-functions/_kubectx
lrwxr-xr-x@  1 brewer  admin   62 25 Sep  2023 /opt/homebrew/share/zsh/site-functions/_kubens -> ../../../Cellar/kubectx/0.9.5/share/zsh/site-functions/_kubens
lrwxr-xr-x   1 brewer  admin   55 21 Aug 07:36 /opt/homebrew/share/zsh/site-functions/_lsd -> ../../../Cellar/lsd/1.1.5/share/zsh/site-functions/_lsd
lrwxr-xr-x@  1 brewer  admin   59 10 Dec 10:35 /opt/homebrew/share/zsh/site-functions/_pipx -> ../../../Cellar/pipx/1.7.1_1/share/zsh/site-functions/_pipx
lrwxr-xr-x@  1 brewer  admin   62 19 Nov 22:34 /opt/homebrew/share/zsh/site-functions/_rclone -> ../../../Cellar/rclone/1.68.2/share/zsh/site-functions/_rclone
lrwxr-xr-x@  1 brewer  admin   57 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions/_ruff -> ../../../Cellar/ruff/0.8.4/share/zsh/site-functions/_ruff
lrwxr-xr-x@  1 brewer  admin   56 10 Dec 23:34 /opt/homebrew/share/zsh/site-functions/_rye -> ../../../Cellar/rye/0.43.0/share/zsh/site-functions/_rye
lrwxr-xr-x   1 brewer  admin   66 20 Oct 18:36 /opt/homebrew/share/zsh/site-functions/_starship -> ../../../Cellar/starship/1.21.1/share/zsh/site-functions/_starship
lrwxr-xr-x@  1 brewer  admin   54 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions/_uv -> ../../../Cellar/uv/0.5.13/share/zsh/site-functions/_uv
lrwxr-xr-x@  1 brewer  admin   55 28 Dec 14:52 /opt/homebrew/share/zsh/site-functions/_uvx -> ../../../Cellar/uv/0.5.13/share/zsh/site-functions/_uvx

What would help is if compaudit actually reported the specific error condition for each directory/file 🤔

[dragon788]

What actually fixed this for me is using compaudit | xargs chmod -L go-w and if there are still errors try compaudit | xargs chown -R -L root:admin or instead of root use brewer, but in my case using root worked on a machine where my sudoer/brew user is separate from my everyday user.

The -L option is only supported for chmod on *nix/BSD and not Linux, but it tells chown/chmod to follow the symlinks and fix the permissions there, because zsh's compaudit might actually be complaining about the TARGET of the symlink and not the filename that shows up first.