# joern を Homebrew でインストール

joern のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:joern
```

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install joern
```

  証拠: local Homebrew formula metadata

## パッケージ情報

- **パッケージキー:** brew:joern
- **パッケージマネージャ:** Homebrew
- **パッケージマネージャページ:** <https://formulae.brew.sh/formula/joern>
- **バージョン:** 4.0.590
- **ソース概要:** Open-source code analysis platform based on code property graphs
- **ホームページ:** <https://joern.io/>
- **リポジトリ:** <https://github.com/joernio/joern>
- **上流ドキュメント:** <https://joern.io/>
- **ライセンス:** Apache-2.0
- **ソースアーカイブ:** <https://github.com/joernio/joern/archive/refs/tags/v4.0.590.tar.gz>
- **最終更新:** 2026-07-28T10:31:06Z
- **生成日時:** 2026-08-04T22:13:35+00:00

## 実行可能ファイル

- abap2cpg (cli)
- c2cpg.sh (cli)
- csharpsrc2cpg (cli)
- ghidra2cpg (cli)
- gosrc2cpg (cli)
- javasrc2cpg (cli)
- jimple2cpg (cli)
- joern (cli)
- joern-cpg2scpg (cli)
- joern-export (cli)
- joern-flow (cli)
- joern-parse (cli)
- joern-scan (cli)
- joern-slice (cli)
- joern-vectors (cli)
- jssrc2cpg.sh (cli)
- kotlin2cpg (cli)
- php2cpg (cli)
- pysrc2cpg (cli)
- rubysrc2cpg (cli)
- rust2cpg (cli)
- schema-extender.sh (cli)
- swiftsrc2cpg.sh (cli)
- abap2cpg (エイリアス)
- c2cpg.sh (エイリアス)
- csharpsrc2cpg (エイリアス)
- ghidra2cpg (エイリアス)
- gosrc2cpg (エイリアス)
- javasrc2cpg (エイリアス)
- jimple2cpg (エイリアス)
- joern (エイリアス)
- joern-cpg2scpg (エイリアス)
- joern-export (エイリアス)
- joern-flow (エイリアス)
- joern-parse (エイリアス)
- joern-scan (エイリアス)
- joern-slice (エイリアス)
- joern-vectors (エイリアス)
- jssrc2cpg.sh (エイリアス)
- kotlin2cpg (エイリアス)
- php2cpg (エイリアス)
- pysrc2cpg (エイリアス)
- rubysrc2cpg (エイリアス)
- rust2cpg (エイリアス)
- schema-extender.sh (エイリアス)
- swiftsrc2cpg.sh (エイリアス)

## 依存関係

- astgen
- coreutils
- openjdk@25
- php

## ビルド依存関係

- sbt

## インストール挙動

- post-install フック: 未定義
- Bottle: 利用可能 対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux

## バージョンと鮮度

- ページ生成日: 2026-08-04
- マネージャ版: 4.0.590
- マネージャ更新日: 2026-07-28
- ローカルデータ: OK
- 上流リポジトリ: https://github.com/joernio/joern
- 検出された最新: v4.0.590 (最新)
## プロジェクトの歴史と使われ方

Joern is an open-source code analysis platform built around code property graphs, a graph representation that lets security researchers query syntax, control flow, and data flow through a Scala-based domain-specific language. Its Homebrew formula packages a large CLI surface, including language frontends and helper commands for parsing, scanning, slicing, exporting, and vectorizing code.

### プロジェクトの歴史

The code property graph idea was introduced in vulnerability-research work on C system code and the Linux kernel. Joern grew from that research lineage into a practical tool for creating and querying CPGs, with later research from 2014 to 2016 extending the representation and 2017 onward work at ShiftLeft turning the format into a broader static-analysis foundation.

The public joernio/joern repository was created in 2019 and the project documentation records several architectural shifts: older Joern versions used general-purpose graph databases and Gremlin, later versions moved to OverflowDB, Joern v2 changed the implementation line from Scala 2 to Scala 3, and Joern v4 moved from OverflowDB to flatgraph.

### 採用の歴史

Joern's adoption is strongest in security research and static-analysis workflows where importing incomplete or build-hostile code is valuable. The documentation lists mature or partially mature frontends for C/C++, Java, JavaScript, Python, binary analysis through Ghidra, JVM bytecode, Kotlin, PHP, Go, Ruby, Swift, and C#.

Homebrew distribution makes Joern convenient on macOS and Linux while preserving its JVM/Scala toolchain shape through OpenJDK and sbt-related packaging.

### 使われ方

A typical Joern workflow parses source, bytecode, or binaries into a CPG, stores the graph in Joern's graph database, and then uses CPGQL or bundled commands such as joern-scan, joern-slice, and joern-export to inspect code patterns and vulnerability-relevant flows.

### パッケージ好きにとっての重要性

Joern matters to package nerds because it turns a research-heavy static-analysis stack into a single installable CLI formula with many frontends. It also shows the unusual packaging profile of modern security tooling: JVM runtime, Scala build tooling, external parsers, and a fast-moving release stream tied to graph storage changes.

### タイムライン

- 2014: Code property graphs were introduced for vulnerability discovery in C system code.
- 2014-2016: Research extended the CPG concept for interprocedural analysis, data-flow learning, dominator-tree integration, and dynamic-language analysis.
- 2017: The CPG became a foundation for static-analysis products at ShiftLeft.
- 2019: The joernio/joern GitHub repository was created.
- 2023: Joern v2 marked the Scala 2 to Scala 3 transition.
- 2026: Joern v4 documented the move from OverflowDB to flatgraph.

### Related projects

- Related projects and concepts include the Code Property Graph specification, Ocular and Qwiet AI, OverflowDB, flatgraph, Ghidra frontends, and the older Gremlin/property-graph ecosystem that influenced early Joern storage and querying.

### ソース

- <https://api.github.com/repos/joernio/joern>
- <https://cpg.joern.io/>
- <https://docs.joern.io/>
- <https://docs.joern.io/code-property-graph/>
- <https://formulae.brew.sh/formula/joern>
- <https://github.com/joernio/joern>


## セキュリティノート

joern に一致するローカルシークレット処理マニフェストは見つかりませんでした。将来の対応で安定したパッケージ URL を使えるよう、パッケージメタデータはここに公開されています。


## ソースデータベース詳細

- **Source Database:** Homebrew formula API
- **Tap:** homebrew/core
- **Full Name:** joern
- **Version Scheme:** 0
- **Revision:** 0
- **Bottle Stable Root URL:** <https://ghcr.io/v2/homebrew/core>
- **Deprecated:** no
- **Disabled:** no
- **Keg Only:** no
- **URL Keys:** stable


## 関連リンク

- [Terminal utility packages](https://pkg.so/ja/terminal-utilities/) - Matched terminal and command-line workflow metadata.
- [Developer build packages](https://pkg.so/ja/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata.
- [Networking and protocol packages](https://pkg.so/ja/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata.
- [Security and crypto packages](https://pkg.so/ja/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata.
- [coreutils](https://pkg.so/ja/brew/coreutils/) - Runtime dependency declared by Homebrew.
- [php](https://pkg.so/ja/brew/php/) - Runtime dependency declared by Homebrew.
- [openjdk@25](https://pkg.so/ja/brew/openjdk-25/) - Runtime dependency declared by Homebrew.
- [astgen](https://pkg.so/ja/brew/astgen/) - Runtime dependency declared by Homebrew.
- [sbt](https://pkg.so/ja/brew/sbt/) - Build dependency declared by Homebrew.
- [zizmor](https://pkg.so/ja/brew/zizmor/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [checkov](https://pkg.so/ja/brew/checkov/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [tfsec](https://pkg.so/ja/brew/tfsec/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [gosec](https://pkg.so/ja/brew/gosec/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [terrascan](https://pkg.so/ja/brew/terrascan/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [bandit](https://pkg.so/ja/brew/bandit/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [flawfinder](https://pkg.so/ja/brew/flawfinder/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [cargo-geiger](https://pkg.so/ja/brew/cargo-geiger/) - Shares pkgdb curated category or tags: cli, security, static-analysis.
- [snyk-delta](https://pkg.so/ja/npm/snyk-delta/) - Security-sensitive metadata or terminology overlaps. Shared terms: analysis, cli, graph, security, source.

## Combined YAML source

View the package source record on GitHub. [combined/joern.yml](https://github.com/mxcl/pkgdb/blob/main/combined/joern.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- package-page enrichment
- curated package history
- package version freshness
- pkgdb category and tag curation
- package relationship graph
- cross-ecosystem install command graph