macOS
Homebrewverified · 100%
brew install libjcatlocal Homebrew formula metadata
brew / rank 4343
Install libjcat with Homebrew, apk, dnf, Nix, pacman, apt, zypper
Library for reading Jcat files. Version 0.2.6 via Homebrew; verified from local package data. Also installable with debian: sudo apt install gir1.2-jcat-1.0.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add libjcatAlpine Linux edge package indexes · libjcat · source: dl-cdn.alpinelinux.org
Fedora dnfverified · 92%
sudo dnf install libjcatFedora Rawhide package metadata · libjcat · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#libjcatnixpkgs package indexes · pkgs/by-name/li/libjcat/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S libjcatArch Linux sync databases · libjcat · source: geo.mirror.pkgbuild.com
Debian aptverified · 92%
sudo apt install gir1.2-jcat-1.0Debian stable package indexes · gir1.2-jcat-1.0 · source: deb.debian.org
openSUSE zypperverified · 92%
sudo zypper install jcat-toolopenSUSE Tumbleweed package metadata · jcat-tool · source: download.opensuse.org
overview
Package summary
Library for reading Jcat files
Project links
Commands and aliases
- jcat-tool
history
Project history and usage
libjcat is a small GObject-oriented library and command-line tool for reading and writing gzip-compressed JSON catalog files. Its niche is software-integrity metadata: a Jcat file can collect checksums and detached signatures for the files in an archive, with support for SHA checksums, GPG signatures, and PKCS#7 signatures.
Project history
Richard Hughes published libjcat as a standalone project in 2020, splitting a catalog-signature concern that matters to firmware distribution into a reusable library. The README describes the format as equivalent in purpose to Microsoft Windows catalog files, but represented as gzipped JSON divided into JcatFile, JcatItem, and JcatBlob objects.
The project grew around firmware-update workflows. Its examples show firmware payloads and metainfo XML carried as catalog items, then signed or verified with local self-signing keys, explicit public keys, or imported detached signatures.
Adoption history
libjcat matters mostly because of fwupd and the Linux Vendor Firmware Service ecosystem. fwupd documentation explains that LVFS adds a .jcat file to uploaded firmware archives so original firmware and metadata are not modified while checksums and detached signatures remain verifiable.
Homebrew, Debian, Fedora, Arch, Nix, Alpine, Ubuntu, and openSUSE package it, which reflects its role as a small shared dependency for firmware and software-integrity tooling rather than as an end-user application.
How it is used
Users usually meet libjcat through jcat-tool, which can create a catalog, add checksums, sign payloads, import detached signatures, export signature blobs, and verify a catalog against a public certificate. Version 2.0.0 added support for signing the checksum of a large payload instead of loading the whole payload for signature verification.
Why package nerds care
For package maintainers, libjcat is interesting because it packages a Windows-like catalog-signature idea in a Unix-friendly library with introspection bindings and a tiny CLI. It is one of those dependencies that looks obscure until a firmware update path needs detached integrity metadata that survives archive repacking.
Timeline
- 2020-03-23: libjcat 0.1.0 release commit.
- 2020: README examples document firmware.bin and firmware.metainfo.xml as typical Jcat archive items.
- 2022-03-22: libjcat 0.1.11 release commit.
- 2023-12-15: README examples document signing the checksum target for large payloads, noting the feature requires JCat 2.0.0 or newer.
Related projects
- fwupd and LVFS are the most visible related projects because they use Jcat files for firmware metadata and payload signature handling. GnuTLS certtool, GPG, PKCS#7, and AppStream-style firmware metadata sit around the same workflow.
Sources
security posture
Risk level: green
library-like package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- library-like package without higher-risk signals
Signals
- metadata:library-like
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
jcat-tool | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version0.2.6
manager updated
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:libjcat |
|---|---|
| Version | 0.2.6 |
| Package manager | Homebrew |
| Homepage | https://github.com/hughsie/libjcat |
| Repository | https://github.com/hughsie/libjcat |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
gir1.2-jcat-1.0 0.2.3-1
GObject introspection data for libjcat
https://github.com/hughsie/libjcat
sudo apt install gir1.2-jcat-1.0- Section: introspection
- Architecture: amd64
- Source Package: libjcat
- 4 dependencies
- normalized package name match
- Matched by: Libjcat
Debian apt95%
jcat 0.2.3-1
JSON catalog library tool
https://github.com/hughsie/libjcat
sudo apt install jcat- Section: libs
- Architecture: amd64
- Source Package: libjcat
- 3 dependencies
- normalized package name match
- Matched by: Libjcat
Debian apt95%
libjcat-dev 0.2.3-1
development files for libjcat
https://github.com/hughsie/libjcat
sudo apt install libjcat-dev- Section: libdevel
- Architecture: amd64
- Source Package: libjcat
- 6 dependencies
- normalized package name match
- Matched by: Libjcat
Debian apt95%
libjcat-tests 0.2.3-1
Installed tests for libjcat1
https://github.com/hughsie/libjcat
sudo apt install libjcat-tests- Section: libs
- Architecture: amd64
- Source Package: libjcat
- 8 dependencies
- normalized package name match
- Matched by: Libjcat
Debian apt95%
libjcat1 0.2.3-1
JSON catalog library
https://github.com/hughsie/libjcat
sudo apt install libjcat1- Section: libs
- Architecture: amd64
- Source Package: libjcat
- 6 dependencies
- normalized package name match
- Matched by: Libjcat
Nix95%
libjcat
nix profile install nixpkgs#libjcat- normalized package name match
- Matched by: Libjcat
Ubuntu apt95%
gir1.2-jcat-1.0 0.2.0-2build3
GObject introspection data for libjcat
https://github.com/hughsie/libjcat
sudo apt install gir1.2-jcat-1.0- Section: introspection
- Architecture: amd64
- Source Package: libjcat
- 4 dependencies
- normalized package name match
- Matched by: Libjcat
Ubuntu apt95%
jcat 0.2.0-2build3
JSON catalog library tool
https://github.com/hughsie/libjcat
sudo apt install jcat- Section: universe/libs
- Architecture: amd64
- Source Package: libjcat
- 3 dependencies
- normalized package name match
- Matched by: Libjcat
Ubuntu apt95%
libjcat-dev 0.2.0-2build3
development files for libjcat
https://github.com/hughsie/libjcat
sudo apt install libjcat-dev- Section: universe/libdevel
- Architecture: amd64
- Source Package: libjcat
- 6 dependencies
- normalized package name match
- Matched by: Libjcat
Ubuntu apt95%
libjcat-tests 0.2.0-2build3
Installed tests for libjcat1
https://github.com/hughsie/libjcat
sudo apt install libjcat-tests- Section: universe/libs
- Architecture: amd64
- Source Package: libjcat
- 9 dependencies
- normalized package name match
- Matched by: Libjcat
Ubuntu apt95%
libjcat1 0.2.0-2build3
JSON catalog library
https://github.com/hughsie/libjcat
sudo apt install libjcat1- Section: libs
- Architecture: amd64
- Source Package: libjcat
- 7 dependencies
- normalized package name match
- Matched by: Libjcat
apk95%
libjcat 0.2.3-r2
Library for reading and writing Jcat files
https://github.com/hughsie/libjcat
sudo apk add libjcat- License: LGPL-2.1-or-later
- Architecture: x86_64
- Source Package: libjcat
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libjcat
apk95%
libjcat-dev 0.2.3-r2
Library for reading and writing Jcat files (development files)
https://github.com/hughsie/libjcat
sudo apk add libjcat-dev- License: LGPL-2.1-or-later
- Architecture: x86_64
- Source Package: libjcat
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libjcat
apk95%
libjcat-doc 0.2.3-r2
Library for reading and writing Jcat files (documentation)
https://github.com/hughsie/libjcat
sudo apk add libjcat-doc- License: LGPL-2.1-or-later
- Architecture: x86_64
- Source Package: libjcat
- normalized package name match
- Matched by: Libjcat
apk95%
libjcat-tools 0.2.3-r2
Library for reading and writing Jcat files
https://github.com/hughsie/libjcat
sudo apk add libjcat-tools- License: LGPL-2.1-or-later
- Architecture: x86_64
- Source Package: libjcat
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libjcat
dnf95%
libjcat 0.2.6-1.fc45
Library for reading Jcat files
https://github.com/hughsie/libjcat
sudo dnf install libjcat- License: LGPL-2.1-or-later
- Category: Unspecified
- Architecture: i686
- Source Package: libjcat
- 11 dependencies
- 2 provides
- normalized package name match
- Matched by: Libjcat
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation