# 使用 Homebrew 安装 tern

查看 tern 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:tern
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install tern
```

  证据: local Homebrew formula metadata

## 软件包事实

- **软件包键:** brew:tern
- **软件包管理器:** Homebrew
- **版本:** 2.12.1
- **来源摘要:** Software Bill of Materials (SBOM) tool
- **主页:** <https://github.com/tern-tools/tern>
- **仓库:** <https://github.com/tern-tools/tern>
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- tern (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 2.12.1
## 项目历史与用法

Tern is a Python-based software composition analysis tool for container images and Dockerfiles. It began as an open-source compliance and package-inspection tool for containers and evolved into an SBOM generator with support for multiple report formats, including SPDX and CycloneDX.

### 项目历史

The repository was created in November 2017 and Tern's first GitHub release was published in July 2018. The FAQ states that Tern was created to help developers meet open-source compliance requirements for containers, where reused filesystem layers make knowing the bill of materials harder.

The README describes Tern's core model: inspect a container image layer by layer, identify distro/package-manager metadata, execute package-manager command-library scripts in a chroot-like environment, and generate reports of package metadata. It can also use a Dockerfile to connect file-system layers back to the lines that produced them.

By the 2.x series, Tern had become explicitly SBOM-focused. Release notes document support for distroless containers and per-layer SBOM output in v2.5.0, build-time inventory of mounted container filesystems in v2.6.1, and SPDX report updates for NTIA minimum SBOM elements and Package URL external references in v2.12.0.

### 采用历史

Tern is distributed as a Python package and a CLI, with README instructions for Linux virtual environments, Docker-based execution, Kubernetes Jobs, Vagrant development environments, and a GitHub Action for scanning Docker container images. Its GitHub metadata and docs place it in the container compliance, supply-chain-security, SPDX, CycloneDX, and SBOM toolchain niche.

### 使用方式

Typical usage is `tern report -i <image>` to generate a report for a container image, with output formats including human-readable, JSON, HTML, YAML, SPDX tag-value, SPDX JSON, and CycloneDX JSON. The README also documents Dockerfile analysis, locked Dockerfile generation, extensions such as Scancode and cve-bin-tool, and workflows for Docker and Kubernetes environments.

### 为什么软件包爱好者会关心

Tern matters to package and dependency specialists because it tries to reconstruct package inventories from container layers rather than only scanning files. That makes it a bridge between OS package-manager metadata, container build history, license/compliance reporting, and modern SBOM interchange formats.

### 时间线

- 2017: GitHub repository created.
- 2018: v0.1.0, named Tern's first release, published.
- 2019: v1.0.0 released.
- 2020: v2.0.0 released.
- 2021: v2.5.0 added distroless-container support and per-layer SBOM output.
- 2021: v2.6.1 added build-time SBOM inventory for mounted container filesystems.
- 2023: v2.12.0 updated SPDX output for NTIA minimum SBOM elements and Package URL external references.

### Related projects

- The README documents integrations or extensions with Scancode and cve-bin-tool.
- The README also points to a Tern GitHub Action maintained separately for scanning Docker container images.

### 来源

- <https://api.github.com/repos/tern-tools/tern>
- <https://api.github.com/repos/tern-tools/tern/releases?per_page=100>
- <https://github.com/tern-tools/tern>
- <https://raw.githubusercontent.com/tern-tools/tern/main/README.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/faq.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_12_0.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_5_0.md>
- <https://raw.githubusercontent.com/tern-tools/tern/main/docs/releases/v2_6_1.md>


## 安全说明

narrow executable package without higher-risk signals.

- **Geiger 风险:** 绿色 / 低
- narrow executable package without higher-risk signals


## Combined YAML source

View the package source record on GitHub. [combined/tern.yml](https://github.com/mxcl/pkgdb/blob/main/combined/tern.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph