Automic VaultAutomic Vault

brew

Install copa with Homebrew

Tool to directly patch container images given the vulnerability scanning results. Version 0.14.2 via Homebrew; verified 2026-07-03.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install copa

local Homebrew formula metadata

overview

Package summary

Tool to directly patch container images given the vulnerability scanning results

Commands and aliases

  • copa

history

Project history and usage

Copa is the CLI for Project Copacetic, a Go and BuildKit-based tool for patching vulnerable container images without doing a full image rebuild.

Project history

The official repository was created in January 2023 and released v0.1.0 the next day. The project developed around direct vulnerability patching: adding a patch layer to existing images based on scanner output rather than forcing users to rebuild from source.

Adoption history

The official site identifies Copacetic as a CNCF Sandbox project and lists ecosystem adoption by Azure Container Registry Continuous Patching, Kubescape, Devtron, and Helmper. It also documents featured talks at KubeCon North America 2024 and OpenSSF SOSS Fusion Conference 2024.

How it is used

Copa is commonly used in CI/CD and image-maintenance workflows. It consumes vulnerability scanning results, has built-in Trivy support, supports third-party scanners, and patches images across multiple Linux package-manager families and platforms.

Why package nerds care

For package and container maintainers, Copa sits at the boundary between OS package updates and container distribution. It is interesting because it turns package-manager-level remediation into a post-build image operation, which can reduce rebuild churn for downstream image consumers.

Timeline

  • 2023: Official GitHub repository created.
  • 2023: v0.1.0 released.
  • 2024: Project featured in KubeCon and OpenSSF talks listed by the official site.
  • 2026: Official site lists Copacetic as a CNCF Sandbox project.

Related projects

  • Official documentation connects Copa with BuildKit, Trivy, Azure Container Registry Continuous Patching, Kubescape, Devtron, and Helmper.

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

  • infrastructure mutation or orchestration signal

Signals

  • text:container

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
copacliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.14.2
manager updated2026-07-03
local dataok
upstreamcurrent
latest detectedv0.14.2

https://github.com/project-copacetic/copacetic

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:copa
Version0.14.2
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/copa
Homepagehttps://project-copacetic.github.io/copacetic/
Repositoryhttps://github.com/project-copacetic/copacetic
Upstream docshttps://project-copacetic.github.io/copacetic
LicenseApache-2.0
Source archivehttps://github.com/project-copacetic/copacetic/archive/refs/tags/v0.14.2.tar.gz
Last updated2026-07-03T03:35:43Z
Pulseupdated
Build dependenciesgo
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecopa
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • goBuild dependency declared by Homebrew.

Same workflow

  • clairShares av.db curated category or tags: cli, containers, security, vulnerability-scanning.
  • vexctlShares av.db curated category or tags: cli, security, vulnerability-management.
  • xeolShares av.db curated category or tags: cli, security, vulnerability-management.
  • bubblewrapShares av.db curated category or tags: cli, containers, security.
  • cargo-auditShares av.db curated category or tags: cli, security, vulnerability-scanning.
  • dalfoxShares av.db curated category or tags: cli, security, vulnerability-scanning.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • package relationship graph
  • package version freshness
  • package-page enrichment