# 使用 Homebrew, apt, dnf, MacPorts 安装 fetch-crl 查看 fetch-crl 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:fetch-crl ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install fetch-crl ``` 证据: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install fetch-crl ``` 证据: MacPorts ports tree: security/fetch-crl/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install fetch-crl ``` 证据: Debian stable package indexes: fetch-crl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install fetch-crl ``` 证据: Fedora Rawhide package metadata: fetch-crl from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/210a2053c8e007daf9ae39c2a21daaed9b2ddd07d63ecffa597050361e73650c-primary.xml.zst ## 软件包事实 - **软件包键:** brew:fetch-crl - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 3.0.23 - **来源摘要:** Retrieve certificate revocation lists (CRLs) - **主页:** - **上游文档:** - **许可证:** Apache-2.0 - **源码归档:** - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - clean-crl (cli) - fetch-crl (cli) - clean-crl (别名) - fetch-crl (别名) ## macOS 提供的库 - perl ## 安装行为 - post-install 钩子: 未定义 - Bottle: 可用 于 arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, monterey, sonoma, ventura, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 3.0.23 - 本地数据: OK - 上游仓库: https://wiki.nikhef.nl/grid/FetchCRL3 - 信息: No package-manager update timestamp was available. - 信息: Release/tag comparison is only available for GitHub repositories. ## 项目历史与用法 fetch-crl is a small but operationally important PKI utility for retrieving certificate revocation lists for installed trust anchors. Its home is grid and research-computing infrastructure rather than end-user security tooling: it reads trust-anchor metadata, downloads CRLs, verifies and formats them, and installs them where OpenSSL, NSS, or other consumers can find them. ### 项目历史 The fetch-crl3 line is a complete rewrite of earlier fetch-crl 1.x and 2.x tools. The project README credits the original fetch-crl to Fabio Hernandez for the EU DataGrid project, notes significant contributions from Steve Traylen, and identifies David Groep as the author of the version 3 rewrite at Nikhef. ### 采用历史 Official Nikhef documentation frames fetch-crl around IGTF-style trust-anchor deployments and points users to the IGTF distribution area for packages. That places the tool in the long-running grid-PKI maintenance path where administrators need repeatable CRL refreshes for certificate authorities rather than an interactive certificate-management application. ### 使用方式 Typical use is unattended Unix administration: fetch-crl reads /etc/fetch-crl.conf by default, can merge drop-in files from /etc/fetch-crl.d, and defaults trust-anchor metadata to /etc/grid-security/certificates. Version 3 added stateful retrieval, HEAD requests, multiple output formats, proxy controls, retry/fallback URLs, per-trust-anchor suppression, and parallel retrieval. ### 为什么软件包爱好者会关心 For package maintainers, fetch-crl is interesting because it is glue code at the boundary between PKI policy, filesystem layout, init or cron scheduling, and library-specific certificate stores. Its version 3 rewrite removed dependencies on shell helpers such as wget and lynx, making the packaged behavior more self-contained and predictable. ### 时间线 - EU DataGrid era: Original fetch-crl developed by Fabio Hernandez. - 2010-2013: fetch-crl3 copyright period in the README for David Groep and Nikhef-related research-grid work. - 3.0: Complete Perl rewrite, preserving the role of earlier 1.x and 2.x utilities while adding stateful retrieval and multiple output formats. - 3.0.23: Official Nikhef documentation lists proxy handling improvements as the package changes in that documentation. ### Related projects - fetch-crl is closely tied to IGTF trust-anchor metadata, OpenSSL hash-directory conventions, NSS databases, and grid-security certificate directories. ### 来源 - - - - ## 安全说明 narrow executable package without higher-risk signals. - **Geiger 风险:** 绿色 / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: /etc/fetch-crl.conf, /etc/fetch-crl.d/ ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** fetch-crl - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## 其他软件包管理器记录 - Debian apt - fetch-crl - 3.0.23-1: normalized package name match | Debian stable package indexes: fetch-crl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3 - Ubuntu apt - fetch-crl - 3.0.22-2: normalized package name match | Ubuntu 24.04 LTS package indexes: fetch-crl from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3 - dnf - fetch-crl - 3.0.23-9.fc45: normalized package name match | Fedora Rawhide package metadata: fetch-crl from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/210a2053c8e007daf9ae39c2a21daaed9b2ddd07d63ecffa597050361e73650c-primary.xml.zst | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3 - MacPorts - fetch-crl: normalized package name match | MacPorts ports tree: security/fetch-crl/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## 相关链接 - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/zh-hans/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://pkg.so/zh-hans/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Documentation packages](https://pkg.so/zh-hans/documentation-tools/) - Matched documentation, manual, or publishing metadata. - [easy-rsa](https://pkg.so/zh-hans/brew/easy-rsa/) - Shares pkgdb curated category or tags: certificates, cli, openssl, pki, security. - [step](https://pkg.so/zh-hans/brew/step/) - Shares pkgdb curated category or tags: certificates, cli, pki, security. - [cfssl](https://pkg.so/zh-hans/brew/cfssl/) - Shares pkgdb curated category or tags: certificates, cli, pki, security. - [redwax-tool](https://pkg.so/zh-hans/brew/redwax-tool/) - Shares pkgdb curated category or tags: certificates, cli, pki, security. - [sslmate](https://pkg.so/zh-hans/brew/sslmate/) - Shares pkgdb curated category or tags: certificate-management, cli, pki, security. - [showcert](https://pkg.so/zh-hans/brew/showcert/) - Shares pkgdb curated category or tags: certificates, cli, openssl, security. - [dnsrobocert](https://pkg.so/zh-hans/brew/dnsrobocert/) - Shares pkgdb curated category or tags: certificate-management, cli, security. - [minica](https://pkg.so/zh-hans/brew/minica/) - Shares pkgdb curated category or tags: certificates, cli, pki, security. ## Combined YAML source View the package source record on GitHub. [combined/fetch-crl.yml](https://github.com/mxcl/pkgdb/blob/main/combined/fetch-crl.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph