# trufflehog を Homebrew, chocolatey, MacPorts, Nix, zypper, scoop でインストール

trufflehog のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:trufflehog
```

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install trufflehog
```

  証拠: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install trufflehog
```

  証拠: MacPorts ports tree: security/trufflehog/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Nix (92%):

```sh
nix profile install nixpkgs#trufflehog
```

  証拠: nixpkgs package indexes: pkgs/by-name/tr/trufflehog/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- zypper (92%):

```sh
sudo zypper install trufflehog
```

  証拠: openSUSE Tumbleweed package metadata: trufflehog from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install trufflehog
```

  証拠: Chocolatey community package catalog: trufflehog from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'

- Scoop (92%):

```sh
scoop install main/trufflehog
```

  証拠: Scoop official bucket manifest trees: bucket/trufflehog.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

## パッケージ情報

- **パッケージキー:** brew:trufflehog
- **パッケージマネージャ:** Homebrew
- **バージョン:** 3.96.0
- **ソース概要:** Find and verify credentials
- **ホームページ:** <https://trufflesecurity.com/>
- **リポジトリ:** <https://github.com/trufflesecurity/trufflehog>
- **最終更新:** 2026-07-26T00:51:28+02:00
- **生成日時:** 2026-08-03T19:37:03+00:00

## 実行可能ファイル

- trufflehog (エイリアス)

## インストール挙動

- Bottle: 利用不可

## バージョンと鮮度

- ページ生成日: 2026-08-03
- マネージャ版: 3.96.0
## プロジェクトの歴史と使われ方

TruffleHog is an open-source secrets scanner for finding, classifying, verifying, and analyzing leaked credentials across Git repositories and many other sources.

### プロジェクトの歴史

The original TruffleHog was written to detect API keys, passwords, and secrets committed to Git. In April 2022, Truffle Security introduced TruffleHog v3 as a major rewrite focused on speed, broader detector coverage, and automatic validation for supported secrets.

The v3 announcement positioned verification as the central change: instead of only matching strings, the scanner can call provider APIs to determine whether a discovered secret is live. The project also moved toward a larger open detector ecosystem, with hundreds of supported key types and contribution paths for new detectors.

The current README describes TruffleHog as a discovery, classification, validation, and analysis tool that scans Git, chats, wikis, logs, API-testing platforms, object stores, filesystems, and more. It also documents enterprise monitoring as a commercial layer while keeping the core scanner open source.

### 採用の歴史

TruffleHog spread because secret leakage is a concrete, recurring operational problem: a key committed once may remain in Git history even after later commits remove it. Truffle Security's GitHub Actions guide shows the tool used in CI to scan pull requests and pushes before leaks move farther into deployment pipelines.

The tool's package-manager footprint is broad: Homebrew, Docker images, binary releases, install scripts, and distro packages all make it easy to drop into local audits, CI jobs, pre-commit workflows, and incident response scripts.

### 使われ方

Common CLI usage includes scanning a remote Git repository, a GitHub organization, a local Git repository, S3 or GCS buckets, Docker images, filesystems, Jira, Slack, and other collaboration surfaces. Security teams often run it with verified-only results to prioritize active credentials.

For package nerds, TruffleHog is a canonical 'install this before you publish or rotate credentials' tool: it is easy to add to a shell, CI workflow, or one-off audit and it returns structured JSON when automation needs to consume findings.

### パッケージ好きにとっての重要性

TruffleHog matters because it turned secrets scanning into a normal CLI/package-manager concern. The same binary can be used interactively with Homebrew, containerized through Docker, or pinned in CI, which fits how security tooling actually lands in developer environments.

Its distinction from simple grep-like scanners is verification. Package users care because reducing false positives changes the economics of adopting a scanner in every repository.

### タイムライン

- Circa 2017: The original TruffleHog is written to find secrets committed to Git, based on the 2022 v3 announcement's five-year lookback.
- 2022-04-04: Truffle Security introduces TruffleHog v3.
- 2023-05-18: Truffle Security documents the TruffleHog GitHub Action for pull request and push scanning.
- 2024-02-21: Truffle Security publishes a detailed explanation of TruffleHog secret verification.

### Related projects

- Gitleaks is mentioned by the v3 announcement as inspiration for some Git improvements.
- GitHub Actions is a common integration surface for running TruffleHog on pull requests and pushes.
- Driftwood is referenced by Truffle Security as a related technique for private encryption key checks.

### ソース

- <https://github.com/trufflesecurity/trufflehog>
- <https://trufflesecurity.com/blog/how-trufflehog-verifies-secrets>
- <https://trufflesecurity.com/blog/introducing-trufflehog-v3>
- <https://trufflesecurity.com/blog/running-trufflehog-in-a-github-action>


## セキュリティノート

trufflehog に一致するローカルシークレット処理マニフェストは見つかりませんでした。将来の対応で安定したパッケージ URL を使えるよう、Nucleus パッケージメタデータはここに公開されています。


## 他のパッケージマネージャ記録

- Nix - trufflehog: normalized package name match | nixpkgs package indexes: pkgs/by-name/tr/trufflehog/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- zypper - trufflehog - 3.96.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: trufflehog from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | CLI tool to find exposed secrets in source and archives | https://github.com/trufflesecurity/trufflehog
- MacPorts - trufflehog: normalized package name match | MacPorts ports tree: security/trufflehog/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
- Chocolatey - trufflehog: normalized package name match | Chocolatey community package catalog: trufflehog from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'
- Scoop - main/trufflehog: normalized package name match | Scoop official bucket manifest trees: bucket/trufflehog.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/trufflehog.yml](https://github.com/mxcl/pkgdb/blob/main/combined/trufflehog.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph