# 使用 Homebrew, apt, dnf, MacPorts 安装 fetch-crl

查看 fetch-crl 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:fetch-crl
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install fetch-crl
```

  证据: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install fetch-crl
```

  证据: MacPorts ports tree: security/fetch-crl/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Debian apt (92%):

```sh
sudo apt install fetch-crl
```

  证据: Debian stable package indexes: fetch-crl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install fetch-crl
```

  证据: Fedora Rawhide package metadata: fetch-crl from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

## 软件包事实

- **软件包键:** brew:fetch-crl
- **软件包管理器:** Homebrew
- **版本:** 3.0.23
- **来源摘要:** Retrieve certificate revocation lists (CRLs)
- **主页:** <https://wiki.nikhef.nl/grid/FetchCRL3>
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- clean-crl (别名)
- fetch-crl (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 3.0.23
## 项目历史与用法

fetch-crl is a small but operationally important PKI utility for retrieving certificate revocation lists for installed trust anchors. Its home is grid and research-computing infrastructure rather than end-user security tooling: it reads trust-anchor metadata, downloads CRLs, verifies and formats them, and installs them where OpenSSL, NSS, or other consumers can find them.

### 项目历史

The fetch-crl3 line is a complete rewrite of earlier fetch-crl 1.x and 2.x tools. The project README credits the original fetch-crl to Fabio Hernandez for the EU DataGrid project, notes significant contributions from Steve Traylen, and identifies David Groep as the author of the version 3 rewrite at Nikhef.

### 采用历史

Official Nikhef documentation frames fetch-crl around IGTF-style trust-anchor deployments and points users to the IGTF distribution area for packages. That places the tool in the long-running grid-PKI maintenance path where administrators need repeatable CRL refreshes for certificate authorities rather than an interactive certificate-management application.

### 使用方式

Typical use is unattended Unix administration: fetch-crl reads /etc/fetch-crl.conf by default, can merge drop-in files from /etc/fetch-crl.d, and defaults trust-anchor metadata to /etc/grid-security/certificates. Version 3 added stateful retrieval, HEAD requests, multiple output formats, proxy controls, retry/fallback URLs, per-trust-anchor suppression, and parallel retrieval.

### 为什么软件包爱好者会关心

For package maintainers, fetch-crl is interesting because it is glue code at the boundary between PKI policy, filesystem layout, init or cron scheduling, and library-specific certificate stores. Its version 3 rewrite removed dependencies on shell helpers such as wget and lynx, making the packaged behavior more self-contained and predictable.

### 时间线

- EU DataGrid era: Original fetch-crl developed by Fabio Hernandez.
- 2010-2013: fetch-crl3 copyright period in the README for David Groep and Nikhef-related research-grid work.
- 3.0: Complete Perl rewrite, preserving the role of earlier 1.x and 2.x utilities while adding stateful retrieval and multiple output formats.
- 3.0.23: Official Nikhef documentation lists proxy handling improvements as the package changes in that documentation.

### Related projects

- fetch-crl is closely tied to IGTF trust-anchor metadata, OpenSSL hash-directory conventions, NSS databases, and grid-security certificate directories.

### 来源

- <https://wiki.nikhef.nl/grid/FetchCRL3>
- <https://github.com/dlgroep/fetch-crl>
- <https://raw.githubusercontent.com/dlgroep/fetch-crl/master/README>
- <https://raw.githubusercontent.com/dlgroep/fetch-crl/master/CHANGES>


## 安全说明

narrow executable package without higher-risk signals.

- **Geiger 风险:** 绿色 / 低
- narrow executable package without higher-risk signals


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: /etc/fetch-crl.conf, /etc/fetch-crl.d/
## 其他软件包管理器记录

- Debian apt - fetch-crl - 3.0.23-1: normalized package name match | Debian stable package indexes: fetch-crl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3
- Ubuntu apt - fetch-crl - 3.0.22-2: normalized package name match | Ubuntu 24.04 LTS package indexes: fetch-crl from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3
- dnf - fetch-crl - 3.0.23-9.fc45: normalized package name match | Fedora Rawhide package metadata: fetch-crl from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Downloads Certificate Revocation Lists | https://wiki.nikhef.nl/grid/FetchCRL3
- MacPorts - fetch-crl: normalized package name match | MacPorts ports tree: security/fetch-crl/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/fetch-crl.yml](https://github.com/mxcl/pkgdb/blob/main/combined/fetch-crl.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph