# 使用 Homebrew, apt, MacPorts, Nix, pacman, zypper, scoop 安装 gitsign 查看 gitsign 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:gitsign ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install gitsign ``` 证据: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install gitsign ``` 证据: MacPorts ports tree: security/gitsign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install gitsign ``` 证据: Debian stable package indexes: gitsign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#gitsign ``` 证据: nixpkgs package indexes: pkgs/by-name/gi/gitsign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S gitsign ``` 证据: Arch Linux sync databases: gitsign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install gitsign ``` 证据: openSUSE Tumbleweed package metadata: gitsign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ### Windows - Scoop (92%): ```sh scoop install main/gitsign ``` 证据: Scoop official bucket manifest trees: bucket/gitsign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## 软件包事实 - **软件包键:** brew:gitsign - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 0.17.1 - **来源摘要:** Keyless Git signing using Sigstore - **主页:** - **仓库:** - **许可证:** Apache-2.0 - **源码归档:** - **最后更新:** 2026-07-30T00:22:27Z - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - gitsign (cli) - gitsign-credential-cache (cli) - gitsign (别名) - gitsign-credential-cache (别名) ## 构建依赖 - go ## 安装行为 - post-install 钩子: 未定义 - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 0.17.1 - 管理器更新时间: 2026-07-30 - 本地数据: OK - 上游仓库: https://github.com/sigstore/gitsign - 检测到的最新版本: v0.17.1 (当前) ## 项目历史与用法 gitsign is a Sigstore tool for keyless signing of Git commits and tags. It uses OpenID Connect identities and Sigstore infrastructure instead of long-lived local signing keys. ### 项目历史 The gitsign repository was created in May 2022 under the Sigstore organization. Its README says the tool was heavily inspired by GitHub's smimesign, but substitutes keyless Sigstore signing with a GitHub or other OIDC identity. ### 采用历史 gitsign belongs to the broader Sigstore supply-chain security ecosystem alongside Fulcio, Rekor, and Cosign. Its adoption story is tied to the move from personal key management toward short-lived certificates, identity-backed signatures, and transparency-log verification. ### 使用方式 Practitioners configure Git to use `gitsign` as the `gpg.x509.program`, set `gpg.format` to `x509`, and then sign commits with `git commit -S` or sign tags with `git tag -s`. Verification commonly uses `gitsign verify` so callers can check both cryptographic integrity and certificate identity claims. ### 为什么软件包爱好者会关心 For package maintainers, gitsign is important because it brings Sigstore's keyless model to Git history rather than only to container images or release artifacts. It packages a security workflow as a Git signing backend with a small CLI surface and a credential-cache helper. ### 时间线 - 2022: Repository created under the Sigstore organization. - 2022: Test release published from the new repository. - 2020s: Distributed through Homebrew, Debian, MacPorts, Nix, Arch, Scoop, and zypper package channels. ### Related projects - gitsign is related to Sigstore, Fulcio, Rekor, Cosign, Git's X.509 signing support, and GitHub's smimesign. ### 来源 - - - - - - - ## 安全说明 narrow executable package without higher-risk signals. - **Geiger 风险:** 绿色 / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: .git/config, ~/.gitconfig ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** gitsign - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 其他软件包管理器记录 - Debian apt - gitsign - 0.13.0-2+b2: normalized package name match | Debian stable package indexes: gitsign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Keyless Git signing using Sigstore (program) | https://github.com/sigstore/gitsign - Debian apt - golang-github-sigstore-gitsign-dev - 0.13.0-2: normalized package name match | Debian stable package indexes: golang-github-sigstore-gitsign-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Keyless Git signing using Sigstore (library) | https://github.com/sigstore/gitsign - Nix - gitsign: normalized package name match | nixpkgs package indexes: pkgs/by-name/gi/gitsign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman - gitsign - 0.14.0-2: normalized package name match | Arch Linux sync databases: gitsign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Keyless Git signing using Sigstore | https://github.com/sigstore/gitsign - zypper - gitsign - 0.17.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: gitsign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Keyless Git signing using Sigstore | https://github.com/sigstore/gitsign - zypper - gitsign-credential-cache - 0.17.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: gitsign-credential-cache from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Credential cache for gitsign | https://github.com/sigstore/gitsign - MacPorts - gitsign: normalized package name match | MacPorts ports tree: security/gitsign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Scoop - main/gitsign: normalized package name match | Scoop official bucket manifest trees: bucket/gitsign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## 相关链接 - [Source-control packages](https://pkg.so/zh-hans/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/zh-hans/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://pkg.so/zh-hans/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [go](https://pkg.so/zh-hans/brew/go/) - Build dependency declared by Homebrew. - [cosign](https://pkg.so/zh-hans/brew/cosign/) - Shares pkgdb curated category or tags: cli, security, sigstore, supply-chain-security. - [sigstore](https://pkg.so/zh-hans/brew/sigstore/) - Shares pkgdb curated category or tags: cli, security, sigstore, supply-chain-security. - [rekor-cli](https://pkg.so/zh-hans/brew/rekor-cli/) - Shares pkgdb curated category or tags: cli, security, sigstore, supply-chain-security. - [gittuf](https://pkg.so/zh-hans/brew/gittuf/) - Shares pkgdb curated category or tags: cli, git, security, supply-chain-security. - [gnupg](https://pkg.so/zh-hans/brew/gnupg/) - Shares pkgdb curated category or tags: cli, security, signing. - [gitleaks](https://pkg.so/zh-hans/brew/gitleaks/) - Shares pkgdb curated category or tags: cli, git, security. - [trufflehog](https://pkg.so/zh-hans/brew/trufflehog/) - Shares pkgdb curated category or tags: cli, git, security. - [zizmor](https://pkg.so/zh-hans/brew/zizmor/) - Shares pkgdb curated category or tags: cli, security, supply-chain-security. - [sh4d0wup](https://pkg.so/zh-hans/brew/sh4d0wup/) - Security-sensitive metadata or terminology overlaps. Shared terms: chain, cli, security, signing, supply. ## Combined YAML source View the package source record on GitHub. [combined/gitsign.yml](https://github.com/mxcl/pkgdb/blob/main/combined/gitsign.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph