# 使用 Homebrew, Nix 安装 credstash 查看 credstash 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:credstash ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install credstash ``` 证据: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#credstash ``` 证据: nixpkgs package indexes: credstash from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix ## 软件包事实 - **软件包键:** brew:credstash - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 1.17.1 - **来源摘要:** Little utility for managing credentials in the cloud - **主页:** - **仓库:** - **许可证:** Apache-2.0 - **源码归档:** - **最后更新:** 2026-05-12T19:39:56Z - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - credstash (cli) - credstash.py (cli) - credstash (别名) - credstash.py (别名) ## 依赖 - cryptography - python@3.14 ## 安装行为 - post-install 钩子: 未定义 - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 1.17.1 - 管理器更新时间: 2026-05-12 - 本地数据: OK - 上游仓库: https://github.com/fugue/credstash - 信息: No cached GitHub release or tag data was available. ## 项目历史与用法 CredStash is a small command-line and Python-library tool for storing secrets with AWS KMS and DynamoDB. It targets teams that want a simple credential store without operating a larger dedicated secrets-management service. ### 项目历史 The README frames CredStash as a response to common ad hoc secret-handling practices such as copying secrets files around a fleet or committing secrets to source control. Its design uses KMS for key wrapping and master-key storage, DynamoDB for encrypted credential records, and AWS IAM for access control. ### 采用历史 The project grew beyond a single Python command-line tool through compatible implementations in Java, Ruby, Scala, PHP, Node.js, Go, C#, Erlang, Rust, and Kubernetes-related tooling listed by the upstream README. Later changelog entries also added operational features such as tags, putall, keys, session handling, YAML and dotenv-style output, and multiple-region KMS/DynamoDB support. ### 使用方式 The standard setup is to install credstash, create or choose a KMS key, ensure AWS credentials are available to boto or botocore, and run credstash setup to create the DynamoDB table. Users then put, get, list, delete, and bulk-fetch versioned secrets from shell scripts or deployment workflows. ### 为什么软件包爱好者会关心 For package maintainers, CredStash is notable as an AWS-backed secrets CLI that keeps its runtime footprint small but relies on cloud-side primitives. Its Homebrew formula exposes a Python security tool to macOS operators who may otherwise install it from pip. ### 时间线 - 2015-12: README documents an auto-versioning behavior change and migration path for older unpadded integer versions - 1.14.0: Added wildcard get, keys, putall, and pagination fixes - 1.15.0: Improved packaging and added credential comments - 1.16.0: Added autoversion API support, DynamoDB table tagging, environment-variable table selection, and custom DynamoDB/KMS sessions - 1.17.0: Added independent KMS-region selection for DynamoDB Global Tables-style deployments ### Related projects - The README lists compatible CredStash implementations for Java, Ruby, Scala, PHP, Node.js, Go, C#, Erlang, Rust, and Kubernetes. ### 来源 - - ## 安全说明 infrastructure mutation or orchestration signal. - **Geiger 风险:** orange / 中 - infrastructure mutation or orchestration signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.aws/config ## Credential files - Unix: ~/.aws/credentials ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** credstash - **Version Scheme:** 0 - **Revision:** 15 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 其他软件包管理器记录 - Nix - credstash: normalized package name match | nixpkgs package indexes: credstash from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix ## 相关链接 - [Cloud CLI packages](https://pkg.so/zh-hans/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://pkg.so/zh-hans/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://pkg.so/zh-hans/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [python@3.14](https://pkg.so/zh-hans/brew/python-3-14/) - Runtime dependency declared by Homebrew. - [openbao](https://pkg.so/zh-hans/brew/openbao/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [secretspec](https://pkg.so/zh-hans/brew/secretspec/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [envchain](https://pkg.so/zh-hans/brew/envchain/) - Shares pkgdb curated category or tags: cli, credentials, secrets-management, security. - [shush](https://pkg.so/zh-hans/brew/shush/) - Shares pkgdb curated category or tags: aws-kms, cli, secrets-management, security. - [doppler](https://pkg.so/zh-hans/brew/doppler/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [ksops](https://pkg.so/zh-hans/brew/ksops/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [envio](https://pkg.so/zh-hans/brew/envio/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [ripsecrets](https://pkg.so/zh-hans/brew/ripsecrets/) - Shares pkgdb curated category or tags: cli, secrets-management, security. - [node-credstasher](https://pkg.so/zh-hans/npm/node-credstasher/) - Security-sensitive metadata or terminology overlaps. Shared terms: aws, aws-kms, cli, credstash, dynamodb. - [keyring](https://pkg.so/zh-hans/brew/keyring/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, credentials, management, python, python-3-14. ## Combined YAML source View the package source record on GitHub. [combined/credstash.yml](https://github.com/mxcl/pkgdb/blob/main/combined/credstash.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph