macOS
Homebrewverified · 100%
brew install fetch-crlprovider-native install command
brew / rank 12541
Install fetch-crl with Homebrew
Retrieve certificate revocation lists (CRLs). Version 3.0.23 via Homebrew; verified from local package data.
install
Additional install commands
overview
Package summary
Retrieve certificate revocation lists (CRLs)
Project links
Commands and aliases
- clean-crl
- fetch-crl
history
Project history and usage
fetch-crl is a small but operationally important PKI utility for retrieving certificate revocation lists for installed trust anchors. Its home is grid and research-computing infrastructure rather than end-user security tooling: it reads trust-anchor metadata, downloads CRLs, verifies and formats them, and installs them where OpenSSL, NSS, or other consumers can find them.
Project history
The fetch-crl3 line is a complete rewrite of earlier fetch-crl 1.x and 2.x tools. The project README credits the original fetch-crl to Fabio Hernandez for the EU DataGrid project, notes significant contributions from Steve Traylen, and identifies David Groep as the author of the version 3 rewrite at Nikhef.
Adoption history
Official Nikhef documentation frames fetch-crl around IGTF-style trust-anchor deployments and points users to the IGTF distribution area for packages. That places the tool in the long-running grid-PKI maintenance path where administrators need repeatable CRL refreshes for certificate authorities rather than an interactive certificate-management application.
How it is used
Typical use is unattended Unix administration: fetch-crl reads /etc/fetch-crl.conf by default, can merge drop-in files from /etc/fetch-crl.d, and defaults trust-anchor metadata to /etc/grid-security/certificates. Version 3 added stateful retrieval, HEAD requests, multiple output formats, proxy controls, retry/fallback URLs, per-trust-anchor suppression, and parallel retrieval.
Why package nerds care
For package maintainers, fetch-crl is interesting because it is glue code at the boundary between PKI policy, filesystem layout, init or cron scheduling, and library-specific certificate stores. Its version 3 rewrite removed dependencies on shell helpers such as wget and lynx, making the packaged behavior more self-contained and predictable.
Timeline
- EU DataGrid era: Original fetch-crl developed by Fabio Hernandez.
- 2010-2013: fetch-crl3 copyright period in the README for David Groep and Nikhef-related research-grid work.
- 3.0: Complete Perl rewrite, preserving the role of earlier 1.x and 2.x utilities while adding stateful retrieval and multiple output formats.
- 3.0.23: Official Nikhef documentation lists proxy handling improvements as the package changes in that documentation.
Related projects
- fetch-crl is closely tied to IGTF trust-anchor metadata, OpenSSL hash-directory conventions, NSS databases, and grid-security certificate directories.
Sources
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
/etc/fetch-crl.conf/etc/fetch-crl.d/
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
clean-crl | executable | indexed executable | Discovered from the local executable index. |
fetch-crl | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version3.0.23
manager updated
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:fetch-crl |
|---|---|
| Version | 3.0.23 |
| Package manager | Homebrew |
| Homepage | https://wiki.nikhef.nl/grid/FetchCRL3 |
| Bottle | not recorded |
| Service | none declared |
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation