# 使用 Homebrew, chocolatey, MacPorts, Nix, zypper, scoop 安装 trufflehog

查看 trufflehog 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:trufflehog
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install trufflehog
```

  证据: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install trufflehog
```

  证据: MacPorts ports tree: security/trufflehog/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Nix (92%):

```sh
nix profile install nixpkgs#trufflehog
```

  证据: nixpkgs package indexes: pkgs/by-name/tr/trufflehog/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- zypper (92%):

```sh
sudo zypper install trufflehog
```

  证据: openSUSE Tumbleweed package metadata: trufflehog from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install trufflehog
```

  证据: Chocolatey community package catalog: trufflehog from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'

- Scoop (92%):

```sh
scoop install main/trufflehog
```

  证据: Scoop official bucket manifest trees: bucket/trufflehog.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

## 软件包事实

- **软件包键:** brew:trufflehog
- **软件包管理器:** Homebrew
- **版本:** 3.96.0
- **来源摘要:** Find and verify credentials
- **主页:** <https://trufflesecurity.com/>
- **仓库:** <https://github.com/trufflesecurity/trufflehog>
- **最后更新:** 2026-07-26T00:51:28+02:00
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- trufflehog (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 3.96.0
## 项目历史与用法

TruffleHog is an open-source secrets scanner for finding, classifying, verifying, and analyzing leaked credentials across Git repositories and many other sources.

### 项目历史

The original TruffleHog was written to detect API keys, passwords, and secrets committed to Git. In April 2022, Truffle Security introduced TruffleHog v3 as a major rewrite focused on speed, broader detector coverage, and automatic validation for supported secrets.

The v3 announcement positioned verification as the central change: instead of only matching strings, the scanner can call provider APIs to determine whether a discovered secret is live. The project also moved toward a larger open detector ecosystem, with hundreds of supported key types and contribution paths for new detectors.

The current README describes TruffleHog as a discovery, classification, validation, and analysis tool that scans Git, chats, wikis, logs, API-testing platforms, object stores, filesystems, and more. It also documents enterprise monitoring as a commercial layer while keeping the core scanner open source.

### 采用历史

TruffleHog spread because secret leakage is a concrete, recurring operational problem: a key committed once may remain in Git history even after later commits remove it. Truffle Security's GitHub Actions guide shows the tool used in CI to scan pull requests and pushes before leaks move farther into deployment pipelines.

The tool's package-manager footprint is broad: Homebrew, Docker images, binary releases, install scripts, and distro packages all make it easy to drop into local audits, CI jobs, pre-commit workflows, and incident response scripts.

### 使用方式

Common CLI usage includes scanning a remote Git repository, a GitHub organization, a local Git repository, S3 or GCS buckets, Docker images, filesystems, Jira, Slack, and other collaboration surfaces. Security teams often run it with verified-only results to prioritize active credentials.

For package nerds, TruffleHog is a canonical 'install this before you publish or rotate credentials' tool: it is easy to add to a shell, CI workflow, or one-off audit and it returns structured JSON when automation needs to consume findings.

### 为什么软件包爱好者会关心

TruffleHog matters because it turned secrets scanning into a normal CLI/package-manager concern. The same binary can be used interactively with Homebrew, containerized through Docker, or pinned in CI, which fits how security tooling actually lands in developer environments.

Its distinction from simple grep-like scanners is verification. Package users care because reducing false positives changes the economics of adopting a scanner in every repository.

### 时间线

- Circa 2017: The original TruffleHog is written to find secrets committed to Git, based on the 2022 v3 announcement's five-year lookback.
- 2022-04-04: Truffle Security introduces TruffleHog v3.
- 2023-05-18: Truffle Security documents the TruffleHog GitHub Action for pull request and push scanning.
- 2024-02-21: Truffle Security publishes a detailed explanation of TruffleHog secret verification.

### Related projects

- Gitleaks is mentioned by the v3 announcement as inspiration for some Git improvements.
- GitHub Actions is a common integration surface for running TruffleHog on pull requests and pushes.
- Driftwood is referenced by Truffle Security as a related technique for private encryption key checks.

### 来源

- <https://github.com/trufflesecurity/trufflehog>
- <https://trufflesecurity.com/blog/how-trufflehog-verifies-secrets>
- <https://trufflesecurity.com/blog/introducing-trufflehog-v3>
- <https://trufflesecurity.com/blog/running-trufflehog-in-a-github-action>


## 安全说明

没有找到 trufflehog 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。


## 其他软件包管理器记录

- Nix - trufflehog: normalized package name match | nixpkgs package indexes: pkgs/by-name/tr/trufflehog/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- zypper - trufflehog - 3.96.0-1.1: normalized package name match | openSUSE Tumbleweed package metadata: trufflehog from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | CLI tool to find exposed secrets in source and archives | https://github.com/trufflesecurity/trufflehog
- MacPorts - trufflehog: normalized package name match | MacPorts ports tree: security/trufflehog/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
- Chocolatey - trufflehog: normalized package name match | Chocolatey community package catalog: trufflehog from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'
- Scoop - main/trufflehog: normalized package name match | Scoop official bucket manifest trees: bucket/trufflehog.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/trufflehog.yml](https://github.com/mxcl/pkgdb/blob/main/combined/trufflehog.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph