Automic VaultAutomic Vault

brew

使用 Homebrew, apk, Nix, pacman, zypper 安装 melange

查看 melange 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装命令安全说明

安装

其他安装命令

macOS

Homebrew已验证 · 100%
brew install melange

local Homebrew formula metadata

Linux

Alpine Linux apk已验证 · 92%
sudo apk add melange

Alpine Linux edge package indexes · melange · 来源: dl-cdn.alpinelinux.org

Nix已验证 · 92%
nix profile install nixpkgs#melange

nixpkgs package indexes · pkgs/by-name/me/melange/package.nix · 来源: api.github.com

Arch Linux pacman已验证 · 92%
sudo pacman -S melange

Arch Linux sync databases · melange · 来源: geo.mirror.pkgbuild.com

openSUSE zypper已验证 · 92%
sudo zypper install melange

openSUSE Tumbleweed package metadata · melange · 来源: download.opensuse.org

概览

软件包摘要

Build APKs from source code

命令和别名

  • melange

历史

项目历史与用法

melange is Chainguard's declarative build tool for producing APK packages from source. The README describes it as a pipeline-oriented APK builder commonly used for packages that feed container images built with apko, especially in the Wolfi and Alpine Linux ecosystems.

项目历史

The project was created for supply-chain-aware package production, where software is built into APK artifacts with controlled pipelines and provenance rather than copied directly into images. The README frames this as part of secure software factories: build and capture software artifacts into packages so images can be assembled from auditable components.

The v0.1.0 release appeared in June 2022. Since then melange has become a core piece of the Chainguard/Wolfi packaging stack, with release automation, multi-architecture support, QEMU-based emulation, pipeline libraries, package signing, and documentation for build files, pipelines, testing, and updates.

采用历史

melange's adoption is strongly tied to Wolfi, Chainguard Images, and apko-based image construction. The upstream README says the majority of its APKs are built for the Wolfi or Alpine Linux ecosystems, and the supplied package facts list Homebrew, Alpine, Nix, pacman, and openSUSE packaging.

For teams building minimal container images, melange provides a package-native alternative to ad hoc Dockerfile build steps. That makes it relevant in reproducible-build and SBOM-heavy workflows where APKs are easier to scan, sign, attest, and reuse.

使用方式

A melange build file declares package metadata, build environment contents, pipeline steps, subpackages, and tests. The README shows melange build examples/gnu-hello.yaml and a containerized invocation with cgr.dev/chainguard/melange.

The tool writes architecture-specific APK outputs under a packages directory. It can generate signing keys with melange keygen and accepts --signing-key during builds.

为什么软件包爱好者会关心

melange is package-nerd catnip because it brings distro-style package recipes into cloud-native image builds. It is small in concept but high leverage: YAML recipes, APK outputs, signing, pipelines, and apko integration let maintainers replace one-off container build scripts with reusable package metadata.

时间线

  • 2022-06-02: Release v0.1.0 published.
  • 2022 onward: melange used with apko, Wolfi, and Alpine-oriented APK production.
  • 2026-06-29: Release v0.55.0 published with ongoing pipeline improvements.

Related projects

  • apko: Chainguard's tool for building OCI images from APK packages.
  • Wolfi: the APK-based Linux distribution ecosystem frequently built with melange.
  • Alpine Linux: the APK package ecosystem whose package format melange targets.

安全态势

尚未找到受保护工具覆盖

没有找到 melange 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。

安装行为

  • formula 元数据中未记录 Homebrew post-install 钩子。
  • Homebrew bottle 元数据适用于 6 个平台目标。
  • 构建元数据列出 1 个构建依赖。

建议审查

在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
melange.yamlmelange.yml

可执行文件

已安装的可执行文件

命令类型暴露范围备注
melangecli全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。

页面生成时间2026-07-25
管理器版本0.56.3
管理器更新时间2026-07-17
本地数据OK
上游当前
检测到的最新版本v0.56.3

https://github.com/chainguard-dev/melange

  • OK没有生成新鲜度警告。

安装元数据

软件包元数据

软件包键brew:melange
版本0.56.3
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/melange
主页https://github.com/chainguard-dev/melange
仓库https://github.com/chainguard-dev/melange
上游文档https://github.com/chainguard-dev/melange
许可证Apache-2.0
源码归档https://github.com/chainguard-dev/melange/archive/refs/tags/v0.56.3.tar.gz
最后更新2026-07-17T15:38:35Z
Pulseupdated
构建依赖go
Bottle可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定义
服务未声明

注册表事实

源数据库详情

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namemelange
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

源数据库匹配

其他软件包管理器记录

匹配项来自外部软件包管理器索引，并与本地 Automic Vault 软件包链接分开显示。

Nix95%

melange

nix profile install nixpkgs#melange
  • normalized package name match
  • 匹配方式：Melange
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/me/melange/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

melange 0.52.1-r0

Build apk packages using declarative pipelines

https://github.com/chainguard-dev/melange

sudo apk add melange
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式：Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-bash-completion 0.52.1-r0

Bash completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-bash-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • 匹配方式：Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-fish-completion 0.52.1-r0

Fish completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-fish-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • 匹配方式：Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
apk95%

melange-zsh-completion 0.52.1-r0

Zsh completions for melange

https://github.com/chainguard-dev/melange

sudo apk add melange-zsh-completion
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: melange
  • normalized package name match
  • 匹配方式：Melange
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: melange-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
pacman95%

melange 0.52.0-1

Build APKs from source code

https://github.com/chainguard-dev/melange

sudo pacman -S melange
  • License: Apache-2.0
  • Architecture: x86_64
  • 4 依赖
  • 1 可选依赖
  • normalized package name match
  • 匹配方式：Melange
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: melange from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
zypper95%

melange 0.52.1-1.1

Build APKs from source code

https://github.com/chainguard-dev/melange

sudo zypper install melange
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: melange
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式：Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-bash-completion 0.52.1-1.1

Bash Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-bash-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式：Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-fish-completion 0.52.1-1.1

Fish Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-fish-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式：Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

melange-zsh-completion 0.52.1-1.1

Zsh Completion for melange

https://github.com/chainguard-dev/melange

sudo zypper install melange-zsh-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: melange
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式：Melange
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: melange-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

软件包图谱

链接来自本地软件包关系图、补充数据、依赖边、生态匹配和软件包 hub 归属。

相关工具

  • goBuild dependency declared by Homebrew.

相同工作流

  • python-buildShares av.db curated category or tags: build-tools, cli, developer-tools, packaging.
  • nfpmShares av.db curated category or tags: apk, cli, developer-tools, packaging.
  • auditwheelShares av.db curated category or tags: cli, developer-tools, packaging.
  • buildkitShares av.db curated category or tags: build-system, build-tools, cli, developer-tools.
  • cargo-bundleShares av.db curated category or tags: cli, developer-tools, packaging.
  • create-dmgShares av.db curated category or tags: cli, developer-tools, packaging.

来源线索

由仓库数据生成

此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment