# 使用 Homebrew 安装 tern 查看 tern 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:tern ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install tern ``` 证据: local Homebrew formula metadata ## 软件包事实 - **软件包键:** brew:tern - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 2.12.1 - **来源摘要:** Software Bill of Materials (SBOM) tool - **主页:** - **仓库:** - **许可证:** BSD-2-Clause - **源码归档:** - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - tern (cli) - tern (别名) ## 依赖 - certifi - libyaml - python@3.14 ## 安装行为 - post-install 钩子: 未定义 - 注意事项: tern requires root privileges so you will need to run `sudo tern`. You should be certain that you trust any software you grant root privileges. - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 2.12.1 - 本地数据: OK - 上游仓库: https://github.com/tern-tools/tern - 信息: No package-manager update timestamp was available. - 信息: No cached GitHub release or tag data was available. ## 项目历史与用法 Tern is a Python-based software composition analysis tool for container images and Dockerfiles. It began as an open-source compliance and package-inspection tool for containers and evolved into an SBOM generator with support for multiple report formats, including SPDX and CycloneDX. ### 项目历史 The repository was created in November 2017 and Tern's first GitHub release was published in July 2018. The FAQ states that Tern was created to help developers meet open-source compliance requirements for containers, where reused filesystem layers make knowing the bill of materials harder. The README describes Tern's core model: inspect a container image layer by layer, identify distro/package-manager metadata, execute package-manager command-library scripts in a chroot-like environment, and generate reports of package metadata. It can also use a Dockerfile to connect file-system layers back to the lines that produced them. By the 2.x series, Tern had become explicitly SBOM-focused. Release notes document support for distroless containers and per-layer SBOM output in v2.5.0, build-time inventory of mounted container filesystems in v2.6.1, and SPDX report updates for NTIA minimum SBOM elements and Package URL external references in v2.12.0. ### 采用历史 Tern is distributed as a Python package and a CLI, with README instructions for Linux virtual environments, Docker-based execution, Kubernetes Jobs, Vagrant development environments, and a GitHub Action for scanning Docker container images. Its GitHub metadata and docs place it in the container compliance, supply-chain-security, SPDX, CycloneDX, and SBOM toolchain niche. ### 使用方式 Typical usage is `tern report -i ` to generate a report for a container image, with output formats including human-readable, JSON, HTML, YAML, SPDX tag-value, SPDX JSON, and CycloneDX JSON. The README also documents Dockerfile analysis, locked Dockerfile generation, extensions such as Scancode and cve-bin-tool, and workflows for Docker and Kubernetes environments. ### 为什么软件包爱好者会关心 Tern matters to package and dependency specialists because it tries to reconstruct package inventories from container layers rather than only scanning files. That makes it a bridge between OS package-manager metadata, container build history, license/compliance reporting, and modern SBOM interchange formats. ### 时间线 - 2017: GitHub repository created. - 2018: v0.1.0, named Tern's first release, published. - 2019: v1.0.0 released. - 2020: v2.0.0 released. - 2021: v2.5.0 added distroless-container support and per-layer SBOM output. - 2021: v2.6.1 added build-time SBOM inventory for mounted container filesystems. - 2023: v2.12.0 updated SPDX output for NTIA minimum SBOM elements and Package URL external references. ### Related projects - The README documents integrations or extensions with Scancode and cve-bin-tool. - The README also points to a Tern GitHub Action maintained separately for scanning Docker container images. ### 来源 - - - - - - - - ## 安全说明 narrow executable package without higher-risk signals. - **Geiger 风险:** 绿色 / 低 - narrow executable package without higher-risk signals ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tern - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 相关链接 - [Cloud CLI packages](https://pkg.so/zh-hans/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://pkg.so/zh-hans/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://pkg.so/zh-hans/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [python@3.14](https://pkg.so/zh-hans/brew/python-3-14/) - Runtime dependency declared by Homebrew. - [cdxgen](https://pkg.so/zh-hans/brew/cdxgen/) - Shares pkgdb curated category or tags: cli, cyclonedx, sbom, security, spdx. - [cyclonedx-cli](https://pkg.so/zh-hans/brew/cyclonedx-cli/) - Shares pkgdb curated category or tags: cli, cyclonedx, sbom, security, spdx. - [cyclonedx-python](https://pkg.so/zh-hans/brew/cyclonedx-python/) - Shares pkgdb curated category or tags: cli, cyclonedx, python, sbom, security. - [bomctl](https://pkg.so/zh-hans/brew/bomctl/) - Shares pkgdb curated category or tags: cli, cyclonedx, sbom, security, spdx. - [syft](https://pkg.so/zh-hans/brew/syft/) - Shares pkgdb curated category or tags: cli, containers, sbom, security. - [retire](https://pkg.so/zh-hans/brew/retire/) - Shares pkgdb curated category or tags: cli, sbom, security, software-composition-analysis. - [cyclonedx-gomod](https://pkg.so/zh-hans/brew/cyclonedx-gomod/) - Shares pkgdb curated category or tags: cli, cyclonedx, sbom, security. - [cargo-cyclonedx](https://pkg.so/zh-hans/brew/cargo-cyclonedx/) - Shares pkgdb curated category or tags: cli, cyclonedx, sbom, security. - [tern](https://pkg.so/zh-hans/npm/tern/) - Same normalized package name appears in another local ecosystem. Shared terms: analysis, cli, tern. - [cve-bin-tool](https://pkg.so/zh-hans/brew/cve-bin-tool/) - Both packages touch the same language runtime or ecosystem. Shared terms: certifi, cli, libyaml, python, python-3-14. - [tern](https://pkg.so/zh-hans/npm/tern/) - Same normalized package name in another local ecosystem. ## Combined YAML source View the package source record on GitHub. [combined/tern.yml](https://github.com/mxcl/pkgdb/blob/main/combined/tern.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - cross-ecosystem install command graph