# depsguard を Homebrew, winget でインストール depsguard のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:depsguard ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install depsguard ``` 証拠: local Homebrew formula metadata ### Windows - winget (92%): ```sh winget install --id Arnica.DepsGuard -e ``` 証拠: Windows Package Manager source index: Arnica.DepsGuard from https://cdn.winget.microsoft.com/cache/source.msix ## パッケージ情報 - **パッケージキー:** brew:depsguard - **パッケージマネージャ:** Homebrew - **パッケージマネージャページ:** - **バージョン:** 0.1.40 - **ソース概要:** Harden package manager configs against supply chain attacks - **ホームページ:** - **リポジトリ:** - **上流ドキュメント:** - **ライセンス:** MIT - **ソースアーカイブ:** - **最終更新:** 2026-06-30T21:29:11Z - **生成日時:** 2026-07-25T07:20:51+00:00 ## 実行可能ファイル - depsguard (cli) - depsguard (エイリアス) ## ビルド依存関係 - rust ## インストール挙動 - post-install フック: 未定義 - Bottle: 利用可能 対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## バージョンと鮮度 - ページ生成日: 2026-07-25 - マネージャ版: 0.1.40 - マネージャ更新日: 2026-06-30 - ローカルデータ: OK - 上流リポジトリ: https://github.com/arnica/depsguard - 検出された最新: v0.1.40 (最新) ## プロジェクトの歴史と使われ方 DepsGuard is a young supply-chain hardening CLI that scans package-manager and dependency-bot configuration files for safer defaults. It focuses on release cooldowns, install-script risk, provenance-related settings, and other package-manager knobs that reduce exposure to dependency confusion and malicious fresh releases. ### プロジェクトの歴史 The official arnica/depsguard repository was created in 2026. The README presents DepsGuard as a single static Rust binary with no third-party Rust crate dependencies, built to scan npm, pnpm, yarn, bun, uv, pip, poetry, aube, Renovate, and Dependabot configs. The project website and README emphasize interactive scanning and fixing: DepsGuard reads known config locations, compares settings to recommended supply-chain defaults, previews diffs, writes backups, and can restore changes. ### 採用の歴史 Because DepsGuard is new, its official adoption record is still mostly packaging and distribution: prebuilt GitHub release binaries, Homebrew core, APT setup, crates.io, WinGet, and Scoop. That packaging breadth suggests the tool is meant for developer workstations as much as CI hardening checks. ### 使われ方 Users can run `depsguard` for an interactive TUI, `depsguard scan` for read-only reporting, or `depsguard restore` to roll back from backups. The tool searches user-level and repo-level package-manager configuration files, including `.github/dependabot.yml` and Renovate files, and only edits files after user approval. ### パッケージ好きにとっての重要性 For package nerds, DepsGuard is notable because it packages a cross-ecosystem security checklist into one binary. Its config table is a snapshot of how many different package managers have grown similar but incompatible concepts for cooldowns, script blocking, trust policy, and registry hardening. ### タイムライン - 2026: Official arnica/depsguard repository created. - 2026: README documents Homebrew core, APT, crates.io, WinGet, and Scoop installation channels. - 2026: Website describes DepsGuard as a one-command scanner and fixer for package-manager security settings. ### Related projects - Related configuration surfaces include npm, pnpm, Yarn, Bun, uv, pip, Poetry, aube, Renovate, and Dependabot. ### ソース - - - ## セキュリティノート depsguard に一致するローカルシークレット処理マニフェストは見つかりませんでした。将来の対応で安定したパッケージ URL を使えるよう、Nucleus パッケージメタデータはここに公開されています。 ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Linux: ~/.npmrc, ~/.config/pnpm/rc, ~/.config/pnpm/config.yaml, ~/.yarnrc.yml, $XDG_CONFIG_HOME/.bunfig.toml, ~/.config/uv/uv.toml, ~/.config/pip/pip.conf, ~/.config/pypoetry/config.toml - macOS: ~/.npmrc, ~/Library/Preferences/pnpm/rc, ~/Library/Preferences/pnpm/config.yaml, ~/.yarnrc.yml, ~/.bunfig.toml, ~/.config/uv/uv.toml, ~/Library/Application Support/pip/pip.conf, ~/Library/Application Support/pypoetry/config.toml - Windows: %LOCALAPPDATA%\pnpm\config\rc, %LOCALAPPDATA%\pnpm\config\config.yaml, %APPDATA%\uv\uv.toml, %APPDATA%\pip\pip.ini, %APPDATA%\pypoetry\config.toml ## ソースデータベース詳細 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** depsguard - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 他のパッケージマネージャ記録 - winget - Arnica.DepsGuard: normalized package name match | Windows Package Manager source index: Arnica.DepsGuard from https://cdn.winget.microsoft.com/cache/source.msix ## 関連リンク - [Package publisher tools](https://www.automicvault.com/ja/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/ja/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/ja/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/ja/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [rust](https://www.automicvault.com/ja/pkg/brew/rust/) - Build dependency declared by Homebrew. - [bumblebee](https://www.automicvault.com/ja/pkg/brew/bumblebee/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [chain-bench](https://www.automicvault.com/ja/pkg/brew/chain-bench/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [malcontent](https://www.automicvault.com/ja/pkg/brew/malcontent/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [minder](https://www.automicvault.com/ja/pkg/brew/minder/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [sh4d0wup](https://www.automicvault.com/ja/pkg/brew/sh4d0wup/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [slsa-verifier](https://www.automicvault.com/ja/pkg/brew/slsa-verifier/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [bagel](https://www.automicvault.com/ja/pkg/brew/bagel/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [bomctl](https://www.automicvault.com/ja/pkg/brew/bomctl/) - Shares av.db curated category or tags: cli, security, supply-chain-security. - [lavamoat](https://www.automicvault.com/ja/pkg/npm/lavamoat/) - Security-sensitive metadata or terminology overlaps. Shared terms: attacks, chain, cli, dependency, security. ## Combined YAML source View the package source record on GitHub. [combined/depsguard.yml](https://github.com/automic-vault/db/blob/main/combined/depsguard.yml) ## ソース - Nucleus package database - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph