Automic VaultAutomic Vault

brew

Install keychain with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

User-friendly front-end to ssh-agent(1). Version 2.9.8 via Homebrew; verified from local package data.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install keychain

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install keychain

MacPorts ports tree · sysutils/keychain/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%
sudo apk add keychain

Alpine Linux edge package indexes · keychain · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install keychain

Debian stable package indexes · keychain · source: deb.debian.org

Fedora dnfverified · 92%
sudo dnf install keychain

Fedora Rawhide package metadata · keychain · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#keychain

nixpkgs package indexes · pkgs/by-name/ke/keychain/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S keychain

Arch Linux sync databases · keychain · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%
sudo zypper install keychain

openSUSE Tumbleweed package metadata · keychain · source: download.opensuse.org

overview

Package summary

User-friendly front-end to ssh-agent(1)

Commands and aliases

  • keychain

history

Project history and usage

Keychain is Daniel Robbins' long-running helper for sharing ssh-agent and gpg-agent state across login shells, remote sessions, cron jobs, and other long-lived user environments. It solves the everyday Unix annoyance of spawning or unlocking a new agent for every terminal.

Project history

Keychain was created by Daniel Robbins and became associated with Gentoo and Funtoo-era shell workflows. The classic implementation was a shell script that wrote reusable environment snippets under the user's home directory so later shells could attach to the same agent.

The project moved back under Daniel Robbins' GitHub account as its official home after a period under Funtoo. In the 2.9 series the project deprecated older options such as --agents, and in the 3.0 beta series it began a ground-up Python 3 rewrite while preserving compatibility with traditional invocations.

Adoption history

Keychain spread widely because it fit naturally into .bash_profile, .zprofile, cron, and remote-login setups. Package-manager coverage across Alpine, Debian, Fedora, Homebrew, MacPorts, Nix, Arch, Ubuntu, and openSUSE reflects how common ssh-agent reuse became for developers and administrators.

How it is used

A typical setup runs keychain during shell startup, evaluates its environment output, and then reuses the existing ssh-agent or gpg-agent rather than prompting for every new session. The 3.0 beta changelog focuses on multi-terminal coordination and more reliable GPG warm-up, which are exactly the rough edges users hit in modern terminal multiplexers, IDE terminals, and WSL sessions.

Why package nerds care

Keychain is a small package with outsized dotfile significance: it is glue between OpenSSH, GnuPG, login shells, and package-managed user environments. It also shows how a simple shell utility can remain useful for decades and later be rewritten without changing the user-facing contract too abruptly.

Timeline

  • 2000s: Keychain became a common Gentoo/Funtoo-associated ssh-agent helper created by Daniel Robbins.
  • 2025: The Funtoo archive noted Daniel Robbins' return as maintainer and pointed to the danielrobbins/keychain GitHub repository as the official home.
  • 2025: Keychain 2.9 deprecated --agents and related legacy behavior.
  • 2026-06: Keychain 3.0.0_beta1 introduced a Python 3 rewrite.
  • 2026: Keychain 3.0.0_beta2 added coordinated multi-terminal initialization and stronger GPG verification behavior.

Related projects

  • Keychain wraps OpenSSH's ssh-agent and ssh-add and can coordinate with gpg-agent. It is adjacent to shell startup frameworks, password managers that expose SSH agents, and OS-native keychain services, but its historical niche is portable Unix shell glue.

security posture

Risk level: blue

broad file, network, media, or database tool signal.

Risk classifier

blue risk · medium confidence · tool

Why

  • broad file, network, media, or database tool signal

Signals

  • text:ssh

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 1 platform targets.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
keychaincliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version2.9.8
manager updated
local dataok
upstreamcurrent
latest detected2.9.8

https://github.com/danielrobbins/keychain

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:keychain
Version2.9.8
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/keychain
Homepagehttps://www.funtoo.org/Keychain
Repositoryhttps://github.com/danielrobbins/keychain
Upstream docshttps://github.com/danielrobbins/keychain#readme
LicenseGPL-2.0-only
Source archivehttps://github.com/danielrobbins/keychain/archive/refs/tags/2.9.8.tar.gz
Bottleavailable (on all)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namekeychain
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

keychain 2.8.5-5

key manager for OpenSSH

https://www.funtoo.org/Keychain

sudo apt install keychain
  • Section: net
  • Architecture: all
  • 2 dependencies
  • 2 optional deps
  • normalized package name match
  • Matched by: Keychain
Debian stable package indexes · deb.debian.org · Debian stable package indexes: keychain from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

keychain

nix profile install nixpkgs#keychain
  • normalized package name match
  • Matched by: Keychain
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ke/keychain/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

keychain 2.8.5-4

key manager for OpenSSH

https://www.funtoo.org/Keychain

sudo apt install keychain
  • Section: universe/net
  • Architecture: all
  • 2 dependencies
  • 2 optional deps
  • normalized package name match
  • Matched by: Keychain
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: keychain from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
apk95%

keychain 2.9.8-r0

keychain ssh-agent front-end

https://github.com/danielrobbins/keychain

sudo apk add keychain
  • License: GPL-2.0-only
  • Architecture: x86_64
  • Source Package: keychain
  • 1 provides
  • normalized package name match
  • Matched by: Keychain
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: keychain from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

keychain-doc 2.9.8-r0

keychain ssh-agent front-end (documentation)

https://github.com/danielrobbins/keychain

sudo apk add keychain-doc
  • License: GPL-2.0-only
  • Architecture: x86_64
  • Source Package: keychain
  • normalized package name match
  • Matched by: Keychain
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: keychain-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
dnf95%

keychain 2.9.8-7.fc45

Agent manager for OpenSSH, ssh.com, Sun SSH, and GnuPG

https://github.com/danielrobbins/keychain

sudo dnf install keychain
  • License: GPL-2.0-only
  • Category: Unspecified
  • Architecture: noarch
  • Source Package: keychain
  • 2 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Keychain
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: keychain from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

keychain 2.9.8-1

A front-end to ssh-agent, allowing one long-running ssh-agent process per system, rather than per login

https://www.funtoo.org/Keychain

sudo pacman -S keychain
  • License: GPL-2.0-only
  • Architecture: any
  • 1 dependencies
  • normalized package name match
  • Matched by: Keychain
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: keychain from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

keychain 2.8.5-3.2

A Key Management Application for SSH2 RSA/DSA and GnuPG Keys

https://www.funtoo.org/Keychain

sudo zypper install keychain
  • License: GPL-2.0-or-later
  • Category: Productivity/Security
  • Architecture: noarch
  • Source Package: keychain
  • 6 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Keychain
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: keychain from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
MacPorts95%

keychain

sudo port install keychain
  • normalized package name match
  • Matched by: Keychain
MacPorts ports tree · api.github.com · MacPorts ports tree: sysutils/keychain/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Same workflow

  • onlykey-agentShares av.db curated category or tags: authentication, cli, gpg-agent, security, ssh-agent.
  • git-credential-libsecretShares av.db curated category or tags: cli, credential-management, security.
  • git-credential-oauthShares av.db curated category or tags: cli, credential-management, security.
  • keyringShares av.db curated category or tags: cli, credential-management, security.
  • leapp-cliShares av.db curated category or tags: cli, credential-management, security.
  • libsecretShares av.db curated category or tags: cli, credential-management, security.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment