Automic VaultAutomic Vault

brew

Install melange with Homebrew, apk, Nix, pacman, zypper

Build APKs from source code. Version 0.56.1 via Homebrew; verified 2026-07-06.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install melange

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%
sudo apk add melange

Alpine Linux edge package indexes · melange · source: dl-cdn.alpinelinux.org

Nixverified · 92%
nix profile install nixpkgs#melange

nixpkgs package indexes · pkgs/by-name/me/melange/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S melange

Arch Linux sync databases · melange · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%
sudo zypper install melange

openSUSE Tumbleweed package metadata · melange · source: download.opensuse.org

overview

Package summary

Build APKs from source code

Commands and aliases

  • melange

history

Project history and usage

melange is Chainguard's declarative build tool for producing APK packages from source. The README describes it as a pipeline-oriented APK builder commonly used for packages that feed container images built with apko, especially in the Wolfi and Alpine Linux ecosystems.

Project history

The project was created for supply-chain-aware package production, where software is built into APK artifacts with controlled pipelines and provenance rather than copied directly into images. The README frames this as part of secure software factories: build and capture software artifacts into packages so images can be assembled from auditable components.

The v0.1.0 release appeared in June 2022. Since then melange has become a core piece of the Chainguard/Wolfi packaging stack, with release automation, multi-architecture support, QEMU-based emulation, pipeline libraries, package signing, and documentation for build files, pipelines, testing, and updates.

Adoption history

melange's adoption is strongly tied to Wolfi, Chainguard Images, and apko-based image construction. The upstream README says the majority of its APKs are built for the Wolfi or Alpine Linux ecosystems, and the supplied package facts list Homebrew, Alpine, Nix, pacman, and openSUSE packaging.

For teams building minimal container images, melange provides a package-native alternative to ad hoc Dockerfile build steps. That makes it relevant in reproducible-build and SBOM-heavy workflows where APKs are easier to scan, sign, attest, and reuse.

How it is used

A melange build file declares package metadata, build environment contents, pipeline steps, subpackages, and tests. The README shows melange build examples/gnu-hello.yaml and a containerized invocation with cgr.dev/chainguard/melange.

The tool writes architecture-specific APK outputs under a packages directory. It can generate signing keys with melange keygen and accepts --signing-key during builds.

Why package nerds care

melange is package-nerd catnip because it brings distro-style package recipes into cloud-native image builds. It is small in concept but high leverage: YAML recipes, APK outputs, signing, pipelines, and apko integration let maintainers replace one-off container build scripts with reusable package metadata.

Timeline

  • 2022-06-02: Release v0.1.0 published.
  • 2022 onward: melange used with apko, Wolfi, and Alpine-oriented APK production.
  • 2026-06-29: Release v0.55.0 published with ongoing pipeline improvements.

Related projects

  • apko: Chainguard's tool for building OCI images from APK packages.
  • Wolfi: the APK-based Linux distribution ecosystem frequently built with melange.
  • Alpine Linux: the APK package ecosystem whose package format melange targets.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for melange. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
melange.yamlmelange.yml

executables

Installed executables

CommandKindExposureNote
melangecliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.56.1
manager updated2026-07-06
local dataok
upstreamcurrent
latest detectedv0.56.1

https://github.com/chainguard-dev/melange

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:melange
Version0.56.1
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/melange
Homepagehttps://github.com/chainguard-dev/melange
Repositoryhttps://github.com/chainguard-dev/melange
Upstream docshttps://github.com/chainguard-dev/melange
LicenseApache-2.0
Source archivehttps://github.com/chainguard-dev/melange/archive/refs/tags/v0.56.1.tar.gz
Last updated2026-07-06T04:50:02Z
Pulseupdated
Build dependenciesgo
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namemelange
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

melange

nix profile install nixpkgs#melange
  • normalized package name match
  • Matched by: Melange
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/me/melange/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

melange 0.52.1-r0

Build apk packages using declarative pipelines

https://github.com/chainguard-dev/melange

sudo apk add melange
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-bash-completion 0.52.1-r0

Bash completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-bash-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • Matched by: Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-fish-completion 0.52.1-r0

Fish completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-fish-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • Matched by: Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-zsh-completion 0.52.1-r0

Zsh completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-zsh-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • Matched by: Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
pacman95%

melange 0.52.0-1

Build APKs from source code

https://github.com/chainguard-dev/melange

sudo pacman -S melange
  • License: Apache-2.0
  • Architecture: x86_64
  • 4 dependencies
  • 1 optional deps
  • normalized package name match
  • Matched by: Melange
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: melange from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

melange 0.52.1-1.1

Build APKs from source code

https://github.com/chainguard-dev/melange

sudo zypper install melange
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: melange
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-bash-completion 0.52.1-1.1

Bash Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-bash-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-fish-completion 0.52.1-1.1

Fish Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-fish-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-zsh-completion 0.52.1-1.1

Zsh Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-zsh-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • goBuild dependency declared by Homebrew.

Same workflow

  • python-buildShares av.db curated category or tags: build-tools, cli, developer-tools, packaging.
  • yeetShares av.db curated category or tags: build-tools, cli, developer-tools, packaging.
  • nfpmShares av.db curated category or tags: apk, cli, developer-tools, packaging.
  • abi3auditShares av.db curated category or tags: cli, developer-tools, packaging.
  • bmakeShares av.db curated category or tags: build-system, build-tools, cli, developer-tools.
  • cargo-bundleShares av.db curated category or tags: cli, developer-tools, packaging.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment