# Install keychain with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper User-friendly front-end to ssh-agent(1). Version 2.9.8 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:keychain ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install keychain ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install keychain ``` Evidence: MacPorts ports tree: sysutils/keychain/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add keychain ``` Evidence: Alpine Linux edge package indexes: keychain from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install keychain ``` Evidence: Debian stable package indexes: keychain from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install keychain ``` Evidence: Fedora Rawhide package metadata: keychain from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#keychain ``` Evidence: nixpkgs package indexes: pkgs/by-name/ke/keychain/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S keychain ``` Evidence: Arch Linux sync databases: keychain from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install keychain ``` Evidence: openSUSE Tumbleweed package metadata: keychain from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:keychain - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.9.8 - **Source summary:** User-friendly front-end to ssh-agent(1) - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-only - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - keychain (cli) - keychain (alias) ## Install behavior - Post-install hook: not defined - Bottle: available on all ## Freshness - Page generated: 2026-07-08 - Package-manager version: 2.9.8 - Local data: ok - Upstream repository: https://github.com/danielrobbins/keychain - Upstream latest detected: 2.9.8 (current) - info: No package-manager update timestamp was available. ## Project history and usage Keychain is Daniel Robbins' long-running helper for sharing ssh-agent and gpg-agent state across login shells, remote sessions, cron jobs, and other long-lived user environments. It solves the everyday Unix annoyance of spawning or unlocking a new agent for every terminal. ### Project history Keychain was created by Daniel Robbins and became associated with Gentoo and Funtoo-era shell workflows. The classic implementation was a shell script that wrote reusable environment snippets under the user's home directory so later shells could attach to the same agent. The project moved back under Daniel Robbins' GitHub account as its official home after a period under Funtoo. In the 2.9 series the project deprecated older options such as --agents, and in the 3.0 beta series it began a ground-up Python 3 rewrite while preserving compatibility with traditional invocations. ### Adoption history Keychain spread widely because it fit naturally into .bash_profile, .zprofile, cron, and remote-login setups. Package-manager coverage across Alpine, Debian, Fedora, Homebrew, MacPorts, Nix, Arch, Ubuntu, and openSUSE reflects how common ssh-agent reuse became for developers and administrators. ### How it is used A typical setup runs keychain during shell startup, evaluates its environment output, and then reuses the existing ssh-agent or gpg-agent rather than prompting for every new session. The 3.0 beta changelog focuses on multi-terminal coordination and more reliable GPG warm-up, which are exactly the rough edges users hit in modern terminal multiplexers, IDE terminals, and WSL sessions. ### Why package nerds care Keychain is a small package with outsized dotfile significance: it is glue between OpenSSH, GnuPG, login shells, and package-managed user environments. It also shows how a simple shell utility can remain useful for decades and later be rewritten without changing the user-facing contract too abruptly. ### Timeline - 2000s: Keychain became a common Gentoo/Funtoo-associated ssh-agent helper created by Daniel Robbins. - 2025: The Funtoo archive noted Daniel Robbins' return as maintainer and pointed to the danielrobbins/keychain GitHub repository as the official home. - 2025: Keychain 2.9 deprecated --agents and related legacy behavior. - 2026-06: Keychain 3.0.0_beta1 introduced a Python 3 rewrite. - 2026: Keychain 3.0.0_beta2 added coordinated multi-terminal initialization and stronger GPG verification behavior. ### Related projects - Keychain wraps OpenSSH's ssh-agent and ssh-add and can coordinate with gpg-agent. It is adjacent to shell startup frameworks, password managers that expose SSH agents, and OS-native keychain services, but its historical niche is portable Unix shell glue. ### Sources - - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** keychain - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - keychain - 2.8.5-5: normalized package name match | Debian stable package indexes: keychain from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | key manager for OpenSSH | https://www.funtoo.org/Keychain - Nix - keychain: normalized package name match | nixpkgs package indexes: pkgs/by-name/ke/keychain/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - keychain - 2.8.5-4: normalized package name match | Ubuntu 24.04 LTS package indexes: keychain from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | key manager for OpenSSH | https://www.funtoo.org/Keychain - apk - keychain - 2.9.8-r0: normalized package name match | Alpine Linux edge package indexes: keychain from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | keychain ssh-agent front-end | https://github.com/danielrobbins/keychain - apk - keychain-doc - 2.9.8-r0: normalized package name match | Alpine Linux edge package indexes: keychain-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | keychain ssh-agent front-end (documentation) | https://github.com/danielrobbins/keychain - dnf - keychain - 2.9.8-7.fc45: normalized package name match | Fedora Rawhide package metadata: keychain from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Agent manager for OpenSSH, ssh.com, Sun SSH, and GnuPG | https://github.com/danielrobbins/keychain - pacman - keychain - 2.9.8-1: normalized package name match | Arch Linux sync databases: keychain from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A front-end to ssh-agent, allowing one long-running ssh-agent process per system, rather than per login | https://www.funtoo.org/Keychain - zypper - keychain - 2.8.5-3.2: normalized package name match | openSUSE Tumbleweed package metadata: keychain from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Key Management Application for SSH2 RSA/DSA and GnuPG Keys | https://www.funtoo.org/Keychain - MacPorts - keychain: normalized package name match | MacPorts ports tree: sysutils/keychain/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [onlykey-agent](https://www.automicvault.com/pkg/brew/onlykey-agent/) - Shares av.db curated category or tags: authentication, cli, gpg-agent, security, ssh-agent. - [git-credential-libsecret](https://www.automicvault.com/pkg/brew/git-credential-libsecret/) - Shares av.db curated category or tags: cli, credential-management, security. - [git-credential-oauth](https://www.automicvault.com/pkg/brew/git-credential-oauth/) - Shares av.db curated category or tags: cli, credential-management, security. - [keyring](https://www.automicvault.com/pkg/brew/keyring/) - Shares av.db curated category or tags: cli, credential-management, security. - [leapp-cli](https://www.automicvault.com/pkg/brew/leapp-cli/) - Shares av.db curated category or tags: cli, credential-management, security. - [libsecret](https://www.automicvault.com/pkg/brew/libsecret/) - Shares av.db curated category or tags: cli, credential-management, security. - [trezor-agent](https://www.automicvault.com/pkg/brew/trezor-agent/) - Shares av.db curated category or tags: cli, gpg-agent, security, ssh-agent. - [acme.sh](https://www.automicvault.com/pkg/brew/acme-sh/) - Shares av.db curated category or tags: cli, security, shell. ## Combined YAML source View the package source record on GitHub. [combined/keychain.yml](https://github.com/automic-vault/db/blob/main/combined/keychain.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph