macOS
Homebrewverifiziert · 100%
brew install chain-benchlocal Homebrew formula metadata
brew
chain-bench mit Homebrew, Nix installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für chain-bench in AI-Agent-Workflows.
Installation
Weitere Installationsbefehle
Linux
Nixverifiziert · 92%
nix profile install nixpkgs#chain-benchnixpkgs package indexes · pkgs/by-name/ch/chain-bench/package.nix · Quelle: api.github.com
Überblick
Paketzusammenfassung
Software supply chain auditing tool based on CIS benchmark
Projektlinks
Befehle und Aliase
- chain-bench
Verlauf
Projektgeschichte und Nutzung
Chain-bench is Aqua Security's open-source CLI for auditing software supply-chain posture against the CIS Software Supply Chain Security Guide. Its history is bound to the 2022 CIS/Aqua push to make supply-chain controls measurable across source code, build pipelines, dependencies, artifacts, and deployment.
Projektgeschichte
Aqua announced Chain-bench on June 22, 2022 alongside the CIS Software Supply Chain Security Guide, describing it as an open-source auditing tool for the new CIS guidelines. The official README says Chain-bench scans the software delivery lifecycle from code time through deploy time and implements CIS Software Supply Chain Benchmark checks.
Adoptionsgeschichte
The official README documents installation through Homebrew, Nix, Docker, GitHub releases, and GitHub Actions, with GitLab CI support described as beta. Aqua's July 2022 blog also listed GitHub Action, Docker image, executable releases, and NixOS package routes, showing the project was designed to be consumed both locally and in CI.
Wie es verwendet wird
Users provide a repository URL and an SCM access token, then run chain-bench scan to collect organization, repository, branch protection, member, and pipeline settings and report pass/fail results for CIS controls. The README documents GitHub and GitLab SCM support, personal access token requirements, Docker usage, and CI integration.
Warum Paket-Nerds sich dafür interessieren
Chain-bench is interesting to package maintainers because it packages a compliance benchmark as a CLI, Docker image, GitHub Action, and distro package instead of only as a SaaS feature. That makes it part of the post-SolarWinds/log4j supply-chain tooling wave where checklists became runnable developer tools.
Zeitleiste
- 2022: Aqua and CIS released the Software Supply Chain Security Guide and Aqua unveiled Chain-bench.
- 2022: Aqua published a getting-started blog for auditing CIS compliance with Chain-bench.
- 2026: The README documents Brew, Nix, Docker, release binaries, GitHub Actions, and beta GitLab CI usage.
Related projects
- Chain-bench is related to the CIS Software Supply Chain Security Guide, Aqua Vulnerability Database compliance checks, Trivy-family Aqua open-source tooling, GitHub Actions, GitLab CI, and SCM platforms such as GitHub and GitLab.
Quellen
Sicherheitslage
Risikostufe: grün
narrow executable package without higher-risk signals.
Risikoklassifikator
grün Risiko · niedrig Konfidenz · appliance
Warum
- narrow executable package without higher-risk signals
Signale
- metadata:no-higher-risk-signals
Installationsverhalten
- In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
- Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
- Build-Metadaten listen 1 Build-Abhängigkeiten.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
chain-bench | cli | globales Executable |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-07-25
Manager-Version0.1.10
Manager aktualisiert
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv0.1.10
https://github.com/aquasecurity/chain-bench
- InfoNo package-manager update timestamp was available.niedrig Konfidenz
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:chain-bench |
|---|---|
| Version | 0.1.10 |
| Paketmanager | Homebrew |
| Paketmanager-Seite | https://formulae.brew.sh/formula/chain-bench |
| Homepage | https://github.com/aquasecurity/chain-bench |
| Repository | https://github.com/aquasecurity/chain-bench |
| Upstream-Dokumentation | https://aquasecurity.github.io/chain-bench |
| Lizenz | Apache-2.0 |
| Quellarchiv | https://github.com/aquasecurity/chain-bench/archive/refs/tags/v0.1.10.tar.gz |
| Build-Abhängigkeiten | go |
| Bottle | verfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | nicht definiert |
| Dienst | keiner deklariert |
Registry-Fakten
Details aus der Quelldatenbank
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | chain-bench |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
Source-Datenbank-Treffer
Andere Paketmanager-Einträge
Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.
Nix95%
chain-bench
nix profile install nixpkgs#chain-bench- normalized package name match
- Abgeglichen nach: Chain Bench
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment