# tern を Homebrew でインストール

tern のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:tern
```

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install tern
```

  証拠: local Homebrew formula metadata

## パッケージ情報

- **パッケージキー:** brew:tern
- **パッケージマネージャ:** Homebrew
- **バージョン:** 2.12.1
- **ソース概要:** Software Bill of Materials (SBOM) tool
- **ホームページ:** <https://github.com/tern-tools/tern>
- **リポジトリ:** <https://github.com/tern-tools/tern>
- **生成日時:** 2026-08-03T19:37:03+00:00

## 実行可能ファイル

- tern (エイリアス)

## インストール挙動

- Bottle: 利用不可

## バージョンと鮮度

- ページ生成日: 2026-08-03
- マネージャ版: 2.12.1
## プロジェクトの歴史と使われ方

Tern is a Python-based software composition analysis tool for container images and Dockerfiles. It began as an open-source compliance and package-inspection tool for containers and evolved into an SBOM generator with support for multiple report formats, including SPDX and CycloneDX.

### プロジェクトの歴史

The repository was created in November 2017 and Tern's first GitHub release was published in July 2018. The FAQ states that Tern was created to help developers meet open-source compliance requirements for containers, where reused filesystem layers make knowing the bill of materials harder.

The README describes Tern's core model: inspect a container image layer by layer, identify distro/package-manager metadata, execute package-manager command-library scripts in a chroot-like environment, and generate reports of package metadata. It can also use a Dockerfile to connect file-system layers back to the lines that produced them.

By the 2.x series, Tern had become explicitly SBOM-focused. Release notes document support for distroless containers and per-layer SBOM output in v2.5.0, build-time inventory of mounted container filesystems in v2.6.1, and SPDX report updates for NTIA minimum SBOM elements and Package URL external references in v2.12.0.

### 採用の歴史

Tern is distributed as a Python package and a CLI, with README instructions for Linux virtual environments, Docker-based execution, Kubernetes Jobs, Vagrant development environments, and a GitHub Action for scanning Docker container images. Its GitHub metadata and docs place it in the container compliance, supply-chain-security, SPDX, CycloneDX, and SBOM toolchain niche.

### 使われ方

Typical usage is `tern report -i <image>` to generate a report for a container image, with output formats including human-readable, JSON, HTML, YAML, SPDX tag-value, SPDX JSON, and CycloneDX JSON. The README also documents Dockerfile analysis, locked Dockerfile generation, extensions such as Scancode and cve-bin-tool, and workflows for Docker and Kubernetes environments.

### パッケージ好きにとっての重要性

Tern matters to package and dependency specialists because it tries to reconstruct package inventories from container layers rather than only scanning files. That makes it a bridge between OS package-manager metadata, container build history, license/compliance reporting, and modern SBOM interchange formats.

### タイムライン

- 2017: GitHub repository created.
- 2018: v0.1.0, named Tern's first release, published.
- 2019: v1.0.0 released.
- 2020: v2.0.0 released.
- 2021: v2.5.0 added distroless-container support and per-layer SBOM output.
- 2021: v2.6.1 added build-time SBOM inventory for mounted container filesystems.
- 2023: v2.12.0 updated SPDX output for NTIA minimum SBOM elements and Package URL external references.

### Related projects

- The README documents integrations or extensions with Scancode and cve-bin-tool.
- The README also points to a Tern GitHub Action maintained separately for scanning Docker container images.

### ソース

- <https://api.github.com/repos/tern-tools/tern>
- <https://api.github.com/repos/tern-tools/tern/releases?per_page=100>
- <https://github.com/tern-tools/tern>
- <https://raw.githubusercontent.com/tern-tools/tern/main/README.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/faq.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_12_0.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_5_0.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_6_1.md>


## セキュリティノート

narrow executable package without higher-risk signals.

- **Geiger リスク:** グリーン / 低
- narrow executable package without higher-risk signals


## Combined YAML source

View the package source record on GitHub. [combined/tern.yml](https://github.com/mxcl/pkgdb/blob/main/combined/tern.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph