Automic VaultAutomic Vault

brew

使用 Homebrew, apk, dnf, Nix 安装 manifest-tool

查看 manifest-tool 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装

其他安装命令

macOS

Homebrew已验证 · 100%
brew install manifest-tool

local Homebrew formula metadata

Linux

Alpine Linux apk已验证 · 92%
sudo apk add manifest-tool

Alpine Linux edge package indexes · manifest-tool · 来源: dl-cdn.alpinelinux.org

Fedora dnf已验证 · 92%
sudo dnf install manifest-tool

Fedora Rawhide package metadata · manifest-tool · 来源: dl.fedoraproject.org

Nix已验证 · 92%
nix profile install nixpkgs#manifest-tool

nixpkgs package indexes · pkgs/by-name/ma/manifest-tool/package.nix · 来源: api.github.com

概览

软件包摘要

Command-line tool to create and query container image manifest list/indexes

命令和别名

  • manifest-tool

历史

项目历史与用法

manifest-tool is a Go command-line utility for inspecting and pushing multi-platform container image manifest lists and OCI image indexes. It helped make multi-architecture container image publishing practical before those workflows were common in mainstream container CLIs.

项目历史

The public repository was created in March 2016. The README describes manifest-tool as one of the first command-line tools capable of assembling Docker v2.2 manifest lists, later more commonly known as OCI image indexes.

The project's history section says the codebase began as a joint project with Harshal Patil from IBM Bangalore and was originally forked from registry client code in skopeo, which later became part of the Red Hat container tooling ecosystem. The v2 rewrite removed the original skopeo-derived code, while the old code remained part of v1 releases.

采用历史

manifest-tool gained relevance during the transition from one-image-per-architecture publishing to a single image reference that can resolve to architecture-specific images. The README notes that Docker's early `docker manifest` command was based on code from manifest-tool through a Docker CLI pull request in early 2018.

The project distributes release binaries for many architectures and also publishes a Docker image, matching the multi-platform audience it serves. By 2026 the repository had hundreds of stars and forks, indicating continued use even after Docker and other container tools added overlapping functionality.

使用方式

Users inspect an image reference with `manifest-tool inspect` to see manifest or index entries and platform support. For publishing, `manifest-tool push` can read a YAML spec or command-line arguments that list platforms, source image templates, target image references, and tags.

For pushing to a registry, the README says credentials can be supplied on the command line, via credential helper support similar to the Docker client, or through an existing Docker client configuration.

为什么软件包爱好者会关心

For package and container infrastructure maintainers, manifest-tool is historically important because it represents the period when multi-arch container images were still being assembled with specialized external tooling. It is also a useful reference point for the evolution from Docker manifest lists to OCI indexes.

时间线

  • 2016: Public GitHub repository created.
  • 2016: Docker v2.2 manifest lists were the target format described by the project.
  • 2018: Docker CLI manifest work drew on manifest-tool code according to the README.
  • 2025: v2.2.0 release published.
  • 2026: v2.2.2 release published.

Related projects

  • The README names skopeo as the original registry-client lineage for early manifest-tool code.
  • The README points to `mquery` as a related utility for querying public image references.
  • The Docker CLI `docker manifest` command is described by the README as having incorporated much of manifest-tool's original functionality.

安全态势

风险级别:orange

broad file, network, media, or database tool signal. infrastructure mutation or orchestration signal.

风险分类器

orange 风险 · 中 置信度 · infrastructure

原因

  • broad file, network, media, or database tool signal
  • infrastructure mutation or orchestration signal

信号

  • text:container
  • text:image

安装行为

  • formula 元数据中未记录 Homebrew post-install 钩子。
  • Homebrew bottle 元数据适用于 6 个平台目标。
  • 构建元数据列出 1 个构建依赖。

建议审查

在无人值守的代理使用前,请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

可执行文件

已安装的可执行文件

命令类型暴露范围备注
manifest-toolcli全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时,才会提示版本落后。

页面生成时间2026-07-08
管理器版本2.2.2
管理器更新时间2026-05-06
本地数据OK
上游当前
检测到的最新版本v2.2.2

https://github.com/estesp/manifest-tool

  • OK没有生成新鲜度警告。

安装元数据

软件包元数据

软件包键brew:manifest-tool
版本2.2.2
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/manifest-tool
主页https://github.com/estesp/manifest-tool/
仓库https://github.com/estesp/manifest-tool
上游文档https://github.com/estesp/manifest-tool#readme
许可证Apache-2.0
源码归档https://github.com/estesp/manifest-tool/archive/refs/tags/v2.2.2.tar.gz
最后更新2026-05-06T12:33:46Z
Pulseupdated
构建依赖go
Bottle可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定义
服务未声明

注册表事实

源数据库详情

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namemanifest-tool
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

源数据库匹配

其他软件包管理器记录

匹配项来自外部软件包管理器索引,并与本地 Automic Vault 软件包链接分开显示。

Nix95%

manifest-tool

nix profile install nixpkgs#manifest-tool
  • normalized package name match
  • 匹配方式:Manifest Tool
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ma/manifest-tool/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

manifest-tool 2.2.1-r4

tool for inspecting and creating multi-platform container images

https://github.com/estesp/manifest-tool

sudo apk add manifest-tool
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: manifest-tool
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式:Manifest Tool
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: manifest-tool from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
dnf95%

manifest-tool 2.0.8-12.fc44

A command line tool used for creating manifest list objects

https://github.com/estesp/manifest-tool

sudo dnf install manifest-tool
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: manifest-tool
  • 2 依赖
  • 2 提供
  • normalized package name match
  • 匹配方式:Manifest Tool
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: manifest-tool from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst

来源线索

由仓库数据生成

此页面由 av-webscripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment