pkg.soopen package index

brew / rank 9825

Install terrahash with Homebrew

Create and store a hash of the Terraform modules used by your configuration. Version 0.1.0 via Homebrew; verified 2026-07-26.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install terrahash

local Homebrew formula metadata

overview

Package summary

Create and store a hash of the Terraform modules used by your configuration

Commands and aliases

  • terrahash

history

Project history and usage

TerraHash is a small Terraform module-locking CLI that creates and checks hashes for modules used by a Terraform configuration.

Project history

The public GitHub repository was created in June 2024. Its README explicitly labels the project as early-stage software, while documenting the core behavior: evaluate initialized Terraform configuration, generate hashes for modules, and store them in a .terraform.module.lock.hcl file analogous to Terraform's provider lock file.

The tool's narrow purpose is supply-chain control for Terraform modules. It checks the lock file against current module hashes and version constraints, then reports changed hashes, changed versions, or missing modules.

Adoption history

Adoption appears niche and security-focused rather than broad. Repository metadata showed a small but visible public audience by July 2026, and Homebrew metadata lists a brew formula for the CLI.

How it is used

The README describes three central commands: terrahash init to create a module lock file, terrahash check to validate current modules against it, and terrahash upgrade to update the lock file after approved changes.

The project is meant to run in CI so deployments can fail when Terraform module code or version constraints diverge from the approved lock file.

Why package nerds care

For package nerds, TerraHash is interesting because it fills a small gap in Terraform's lock-file story: Terraform has a provider lock file, while this tool experiments with a separate module lock file that can be installed as a simple CLI.

Timeline

  • 2024: Public GitHub repository created.
  • 2024: README documents init, check, and upgrade workflows around .terraform.module.lock.hcl.
  • 2026: Homebrew metadata lists terrahash as a packaged CLI.

Related projects

  • Terraform supplies the module system and provider lock-file pattern that TerraHash mirrors.
  • Terragrunt and Terramate are adjacent Terraform workflow tools, but TerraHash is focused specifically on module hash verification.

Sources

  • Input package metadata: source_facts.package-manager, source_facts.package-manager-url
  • README: https://github.com/ned1313/terrahash#readme
  • Repository metadata: https://api.github.com/repos/ned1313/terrahash

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
terrahashexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version0.1.0
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:terrahash
Version0.1.0
Package managerHomebrew
Homepagehttps://github.com/ned1313/terrahash
Repositoryhttps://github.com/ned1313/terrahash
Last updated2026-07-26T00:50:36+02:00
Pulseupdated
Bottlenot recorded
Servicenone declared

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • pkg.so package database
  • pkgdb category and tag curation