# 使用 Homebrew, apt, MacPorts, Nix, pacman, zypper, scoop 安装 gitsign 查看 gitsign 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:gitsign ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install gitsign ``` 证据: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install gitsign ``` 证据: MacPorts ports tree: security/gitsign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install gitsign ``` 证据: Debian stable package indexes: gitsign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#gitsign ``` 证据: nixpkgs package indexes: pkgs/by-name/gi/gitsign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S gitsign ``` 证据: Arch Linux sync databases: gitsign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install gitsign ``` 证据: openSUSE Tumbleweed package metadata: gitsign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ### Windows - Scoop (92%): ```sh scoop install main/gitsign ``` 证据: Scoop official bucket manifest trees: bucket/gitsign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## 软件包事实 - **软件包键:** brew:gitsign - **软件包管理器:** Homebrew - **版本:** 0.17.1 - **来源摘要:** Keyless Git signing using Sigstore - **主页:** - **仓库:** - **最后更新:** 2026-07-30T00:22:27Z - **已生成:** 2026-08-03T19:37:03+00:00 ## 可执行文件 - gitsign (别名) - gitsign-credential-cache (别名) ## 安装行为 - Bottle: 不可用 ## 版本和新鲜度 - 页面生成时间: 2026-08-03 - 管理器版本: 0.17.1 ## 项目历史与用法 gitsign is a Sigstore tool for keyless signing of Git commits and tags. It uses OpenID Connect identities and Sigstore infrastructure instead of long-lived local signing keys. ### 项目历史 The gitsign repository was created in May 2022 under the Sigstore organization. Its README says the tool was heavily inspired by GitHub's smimesign, but substitutes keyless Sigstore signing with a GitHub or other OIDC identity. ### 采用历史 gitsign belongs to the broader Sigstore supply-chain security ecosystem alongside Fulcio, Rekor, and Cosign. Its adoption story is tied to the move from personal key management toward short-lived certificates, identity-backed signatures, and transparency-log verification. ### 使用方式 Practitioners configure Git to use `gitsign` as the `gpg.x509.program`, set `gpg.format` to `x509`, and then sign commits with `git commit -S` or sign tags with `git tag -s`. Verification commonly uses `gitsign verify` so callers can check both cryptographic integrity and certificate identity claims. ### 为什么软件包爱好者会关心 For package maintainers, gitsign is important because it brings Sigstore's keyless model to Git history rather than only to container images or release artifacts. It packages a security workflow as a Git signing backend with a small CLI surface and a credential-cache helper. ### 时间线 - 2022: Repository created under the Sigstore organization. - 2022: Test release published from the new repository. - 2020s: Distributed through Homebrew, Debian, MacPorts, Nix, Arch, Scoop, and zypper package channels. ### Related projects - gitsign is related to Sigstore, Fulcio, Rekor, Cosign, Git's X.509 signing support, and GitHub's smimesign. ### 来源 - - - - - - - ## 安全说明 narrow executable package without higher-risk signals. - **Geiger 风险:** 绿色 / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: .git/config, ~/.gitconfig ## 其他软件包管理器记录 - Debian apt - gitsign - 0.13.0-2+b2: normalized package name match | Debian stable package indexes: gitsign from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Keyless Git signing using Sigstore (program) | https://github.com/sigstore/gitsign - Debian apt - golang-github-sigstore-gitsign-dev - 0.13.0-2: normalized package name match | Debian stable package indexes: golang-github-sigstore-gitsign-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Keyless Git signing using Sigstore (library) | https://github.com/sigstore/gitsign - Nix - gitsign: normalized package name match | nixpkgs package indexes: pkgs/by-name/gi/gitsign/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman - gitsign - 0.14.0-2: normalized package name match | Arch Linux sync databases: gitsign from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Keyless Git signing using Sigstore | https://github.com/sigstore/gitsign - zypper - gitsign - 0.17.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: gitsign from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Keyless Git signing using Sigstore | https://github.com/sigstore/gitsign - zypper - gitsign-credential-cache - 0.17.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: gitsign-credential-cache from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Credential cache for gitsign | https://github.com/sigstore/gitsign - MacPorts - gitsign: normalized package name match | MacPorts ports tree: security/gitsign/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Scoop - main/gitsign: normalized package name match | Scoop official bucket manifest trees: bucket/gitsign.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/gitsign.yml](https://github.com/mxcl/pkgdb/blob/main/combined/gitsign.yml) ## 来源 - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph