# bandit を Homebrew, apt, MacPorts, Nix, pacman でインストール bandit のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:bandit ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install bandit ``` 証拠: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install bandit ``` 証拠: MacPorts ports tree: python/bandit/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install bandit ``` 証拠: Debian stable package indexes: bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#bandit ``` 証拠: nixpkgs package indexes: bandit from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - pacman (92%): ```sh sudo pacman -S bandit ``` 証拠: Arch Linux sync databases: bandit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## パッケージ情報 - **パッケージキー:** brew:bandit - **パッケージマネージャ:** Homebrew - **バージョン:** 1.9.4 - **ソース概要:** Security-oriented static analyser for Python code - **ホームページ:** - **リポジトリ:** - **生成日時:** 2026-08-03T19:37:03+00:00 ## 実行可能ファイル - bandit (エイリアス) - bandit-baseline (エイリアス) - bandit-config-generator (エイリアス) ## インストール挙動 - Bottle: 利用不可 ## バージョンと鮮度 - ページ生成日: 2026-08-03 - マネージャ版: 1.9.4 ## プロジェクトの歴史と使われ方 Bandit is PyCQA's Python security linter: a command-line static analyzer that parses Python files into ASTs and runs security-focused plugins against the tree. It is one of the standard package-manager tools for lightweight Python application security checks. ### プロジェクトの歴史 The official README says Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA. Its public Git history begins in July 2014, with 0.9.0 tagged in February 2015 and a steady 1.x release line since then. Bandit's architecture reflects the Python tooling style of its era: it uses Python's AST module, reports issue IDs such as B101 and B602, and exposes command-line, baseline, and config-generation executables for local use and CI automation. ### 採用の歴史 Bandit's adoption broadened from OpenStack security work into the general Python quality-tooling ecosystem after it moved under PyCQA. The supplied package facts list Homebrew, Debian/Ubuntu, MacPorts, Nix, Arch, and related packaging, and the official README advertises PyPI, container images, and GitHub Actions-built images. The project also became part of common Python CI and pre-commit workflows: the official docs include integration and CI/CD sections, and the configuration docs show usage through pre-commit with the official PyCQA repository. ### 使われ方 Bandit scans Python source recursively, builds ASTs, runs security plugins, and emits reports. Common usage is local scanning with bandit -r ., CI enforcement, baseline comparison, and per-line suppression with nosec comments when a finding has been reviewed. Configuration can live in a .bandit INI file for recursive project scans, or in YAML/TOML files such as bandit.yaml and pyproject.toml when passed with -c. The docs also describe generated configs and plugin-specific overrides. ### パッケージ好きにとっての重要性 Bandit matters in package catalogs because it is security tooling with a tiny operational footprint: easy to add to CI, easy to vendor into developer images, and easy for distributions to expose as a CLI. It also illustrates the consolidation of Python QA tools under PyCQA, alongside linters and format-adjacent tooling that package managers routinely provide for reproducible developer environments. ### タイムライン - 2014: Public Git history begins in the official repository. - 2015: 0.9.0 is tagged, followed by frequent early releases. - 2010s: Bandit moves from the OpenStack Security Project to PyCQA, according to the official README. - 2020s: Bandit is distributed through PyPI, OS package managers, pre-commit workflows, and signed container images. - 2026: 1.9.x releases continue maintenance of the analyzer and rule set. ### Related projects - Bandit is related to PyCQA tooling, Python's AST module, pre-commit, and broader Python security/static-analysis tools. It complements general-purpose linters by focusing specifically on common security issues. ### ソース - - - - - input.source_facts.package-manager ## セキュリティノート narrow executable package without higher-risk signals. - **Geiger リスク:** グリーン / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: .bandit, bandit.yaml, pyproject.toml ## 他のパッケージマネージャ記録 - Debian apt - bandit - 1.7.10-2: normalized package name match | Debian stable package indexes: bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Security oriented static analyzer for Python code - Metapackage | https://github.com/PyCQA/bandit - Debian apt - python3-bandit - 1.7.10-2: normalized package name match | Debian stable package indexes: python3-bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Security oriented static analyzer for Python code - Python 3.x | https://github.com/PyCQA/bandit - Nix - bandit: normalized package name match | nixpkgs package indexes: bandit from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - Ubuntu apt - bandit - 1.6.2-3: normalized package name match | Ubuntu 24.04 LTS package indexes: bandit from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Security oriented static analyzer for Python code - Metapackage | https://github.com/PyCQA/bandit - Ubuntu apt - python3-bandit - 1.6.2-3: normalized package name match | Ubuntu 24.04 LTS package indexes: python3-bandit from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Security oriented static analyzer for Python code - Python 3.x | https://github.com/PyCQA/bandit - pacman - bandit - 1.9.4-1: normalized package name match | Arch Linux sync databases: bandit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Python security linter from OpenStack Security | https://github.com/PyCQA/bandit - MacPorts - bandit: normalized package name match | MacPorts ports tree: python/bandit/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/bandit.yml](https://github.com/mxcl/pkgdb/blob/main/combined/bandit.yml) ## ソース - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph