安装

其他安装命令

macOS

Homebrew已验证 · 100%

brew install tern

local Homebrew formula metadata

概览

软件包摘要

Software Bill of Materials (SBOM) tool

项目链接

命令和别名

tern

历史

项目历史与用法

Tern is a Python-based software composition analysis tool for container images and Dockerfiles. It began as an open-source compliance and package-inspection tool for containers and evolved into an SBOM generator with support for multiple report formats, including SPDX and CycloneDX.

项目历史

The repository was created in November 2017 and Tern's first GitHub release was published in July 2018. The FAQ states that Tern was created to help developers meet open-source compliance requirements for containers, where reused filesystem layers make knowing the bill of materials harder.

The README describes Tern's core model: inspect a container image layer by layer, identify distro/package-manager metadata, execute package-manager command-library scripts in a chroot-like environment, and generate reports of package metadata. It can also use a Dockerfile to connect file-system layers back to the lines that produced them.

By the 2.x series, Tern had become explicitly SBOM-focused. Release notes document support for distroless containers and per-layer SBOM output in v2.5.0, build-time inventory of mounted container filesystems in v2.6.1, and SPDX report updates for NTIA minimum SBOM elements and Package URL external references in v2.12.0.

采用历史

Tern is distributed as a Python package and a CLI, with README instructions for Linux virtual environments, Docker-based execution, Kubernetes Jobs, Vagrant development environments, and a GitHub Action for scanning Docker container images. Its GitHub metadata and docs place it in the container compliance, supply-chain-security, SPDX, CycloneDX, and SBOM toolchain niche.

使用方式

Typical usage is `tern report -i <image>` to generate a report for a container image, with output formats including human-readable, JSON, HTML, YAML, SPDX tag-value, SPDX JSON, and CycloneDX JSON. The README also documents Dockerfile analysis, locked Dockerfile generation, extensions such as Scancode and cve-bin-tool, and workflows for Docker and Kubernetes environments.

为什么软件包爱好者会关心

Tern matters to package and dependency specialists because it tries to reconstruct package inventories from container layers rather than only scanning files. That makes it a bridge between OS package-manager metadata, container build history, license/compliance reporting, and modern SBOM interchange formats.

时间线

2017: GitHub repository created.
2018: v0.1.0, named Tern's first release, published.
2019: v1.0.0 released.
2020: v2.0.0 released.
2021: v2.5.0 added distroless-container support and per-layer SBOM output.
2021: v2.6.1 added build-time SBOM inventory for mounted container filesystems.
2023: v2.12.0 updated SPDX output for NTIA minimum SBOM elements and Package URL external references.

Related projects

The README documents integrations or extensions with Scancode and cve-bin-tool.
The README also points to a Tern GitHub Action maintained separately for scanning Docker container images.

来源

安全态势

风险级别：绿色

narrow executable package without higher-risk signals.

风险分类器

绿色风险 · 低置信度 · appliance

原因

narrow executable package without higher-risk signals

信号

metadata:no-higher-risk-signals

安装行为

formula 元数据中未记录 Homebrew post-install 钩子。
Homebrew bottle 元数据适用于 6 个平台目标。
安装时包含 3 个运行时依赖。

建议审查

在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

可执行文件

已安装的可执行文件

命令	类型	暴露范围	备注
`tern`	cli	全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。

页面生成时间2026-07-26

管理器版本2.12.1

管理器更新时间

本地数据OK

上游not checked

检测到的最新版本未检测到

https://github.com/tern-tools/tern

信息No package-manager update timestamp was available.低置信度
信息No cached GitHub release or tag data was available.https://github.com/tern-tools/ternnone 置信度

安装元数据

软件包元数据

软件包键	brew:tern
版本	2.12.1
软件包管理器	Homebrew
软件包管理器页面	https://formulae.brew.sh/formula/tern
主页	https://github.com/tern-tools/tern
仓库	https://github.com/tern-tools/tern
上游文档	https://github.com/tern-tools/tern#readme
许可证	BSD-2-Clause
源码归档	https://files.pythonhosted.org/packages/f8/4b/123b2ca469126b45e61853acf028fe1d466f4fe1d5e7afd1d4972c151b4d/tern-2.12.1.tar.gz
依赖	certifi, libyaml, python@3.14
Bottle	可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	未定义
服务	未声明
注意事项	tern requires root privileges so you will need to run `sudo tern`. You should be certain that you trust any software you grant root privileges.

注册表事实

源数据库详情

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	tern
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

软件包图谱

链接来自本地软件包关系图、补充数据、依赖边、生态匹配和软件包 hub 归属。

来源线索

由仓库数据生成

此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

Combined YAML source

View the package source record on GitHub.

combined/tern.yml

使用的来源

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
package relationship graph
package version freshness
package-page enrichment

使用 Homebrew 安装 tern