Automic VaultAutomic Vault

brew

使用 Homebrew, Nix, zypper 安装 werf

查看 werf 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装

其他安装命令

macOS

Homebrew已验证 · 100%
brew install werf

local Homebrew formula metadata

Linux

Nix已验证 · 92%
nix profile install nixpkgs#werf

nixpkgs package indexes · pkgs/by-name/we/werf/package.nix · 来源: api.github.com

openSUSE zypper已验证 · 92%
sudo zypper install werf

openSUSE Tumbleweed package metadata · werf · 来源: download.opensuse.org

概览

软件包摘要

Consistent delivery tool for Kubernetes

历史

项目历史与用法

werf is a Kubernetes delivery CLI from the Flant ecosystem and a CNCF Sandbox project. The project describes itself as a full-cycle CI/CD tool that glues together Git, Dockerfile or Buildah image building, Helm-style deployment, Kubernetes, and a user's existing CI system.

项目历史

The project began in January 2016 under the earlier `dapp` name, before Kubernetes deployment became central to its identity. The official tenth-anniversary history describes the starting point as an experiment in incremental Docker image building that later grew into an open source delivery ecosystem for Kubernetes applications.

In March 2017, dapp gained Kubernetes deployment via Helm charts, shifting the tool from image building toward end-to-end application delivery. The public GitHub repository dates to January 2016, and werf's own retrospective groups the pre-2019 period as the dapp and early werf era before the v1 line.

werf v1 covered the December 2018 through March 2020 transition, while the v1.1 and v1.2 eras added production-oriented behavior such as content-based tagging, distributed layer storage, bundles, and increasingly reproducible deployment artifacts. In May 2023, the project began moving away from its Helm fork toward Nelm, a Helm-compatible deployment engine developed as part of the broader werf ecosystem.

On December 13, 2022, CNCF accepted werf at Sandbox maturity. That gave the project formal cloud-native foundation status and framed it as a community project rather than only a vendor-maintained delivery tool.

采用历史

werf's README says it has been used in production since 2017 and that thousands of projects rely on it. The 2026 anniversary post gives a more concrete ecosystem snapshot: 4600+ GitHub stars, 1300+ releases, 18,000+ active projects using werf, 15,000+ commits, 60+ contributors, and 6000+ merged pull requests.

Its adoption pattern is strongest among teams that want CI/CD behavior in Git but do not want to replace their existing CI service. werf is designed to run inside GitLab CI, GitHub Actions, or other CI systems while owning the build, publish, deploy, tracking, and cleanup parts of a Kubernetes release.

使用方式

A typical werf project keeps a `werf.yaml` file in the source tree and lets the CLI build container images, publish them to a registry, deploy Helm-compatible charts to Kubernetes, track rollout status, and clean old artifacts. This makes werf closer to an application delivery orchestrator than a single-purpose image builder.

In package terms, werf matters because it packages several common cloud-native primitives into one repeatable CLI workflow. That role also explains its related projects: Nelm for Helm-compatible deployment, trdl for update channels, kubedog for Kubernetes rollout tracking, and lockgate for synchronization.

时间线

  • January 2016: project starts as dapp, focused on incremental Docker image building.
  • March 2017: Kubernetes deployment via Helm becomes part of the tool.
  • December 2018-March 2020: the v1 era establishes the werf identity.
  • March-April 2020: content-based tagging and distributed layer storage improve image handling in concurrent CI environments.
  • November 2020-April 2024: the v1.2 era adds bundle-oriented distribution and broader production delivery behavior.
  • December 13, 2022: werf joins CNCF as a Sandbox project.
  • May 2023: the deployment subsystem begins the move away from a Helm fork toward Nelm.
  • April 2024 onward: werf v2 begins, with ongoing ecosystem work around Nelm and delivery tooling.

安全态势

风险级别:orange

infrastructure mutation or orchestration signal.

风险分类器

orange 风险 · 中 置信度 · infrastructure

原因

  • infrastructure mutation or orchestration signal

信号

  • text:kubernetes

安装行为

  • formula 元数据中未记录 Homebrew post-install 钩子。
  • Homebrew bottle 元数据适用于 6 个平台目标。
  • 构建元数据列出 1 个构建依赖。

建议审查

在无人值守的代理使用前,请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
werf.yaml

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
~/.werf/global_secret_key.werf_secret_key

可执行文件

已安装的可执行文件

命令类型暴露范围备注
werfcli全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时,才会提示版本落后。

页面生成时间2026-07-25
管理器版本2.73.2
管理器更新时间2026-07-21
本地数据OK
上游当前
检测到的最新版本v2.73.2

https://github.com/werf/werf

  • OK没有生成新鲜度警告。

安装元数据

软件包元数据

软件包键brew:werf
版本2.73.2
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/werf
主页https://werf.io/
仓库https://github.com/werf/werf
上游文档https://werf.io/docs
许可证Apache-2.0
源码归档https://github.com/werf/werf/archive/refs/tags/v2.73.2.tar.gz
最后更新2026-07-21T10:16:43Z
Pulseupdated
构建依赖go
Bottle可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定义
服务未声明

注册表事实

源数据库详情

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namewerf
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

源数据库匹配

其他软件包管理器记录

匹配项来自外部软件包管理器索引,并与本地 Automic Vault 软件包链接分开显示。

Nix95%

werf

nix profile install nixpkgs#werf
  • normalized package name match
  • 匹配方式:Werf
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/we/werf/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
zypper95%

werf 2.68.2-1.1

CLI for the Werf CI/CD system

https://github.com/werf/werf

sudo zypper install werf
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: werf
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式:Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-bash-completion 2.68.2-1.1

Bash Completion for werf

https://github.com/werf/werf

sudo zypper install werf-bash-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 2 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式:Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-fish-completion 2.68.2-1.1

Fish Completion for werf

https://github.com/werf/werf

sudo zypper install werf-fish-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式:Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-zsh-completion 2.68.2-1.1

Zsh Completion for werf

https://github.com/werf/werf

sudo zypper install werf-zsh-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 1 依赖
  • 1 提供
  • normalized package name match
  • 匹配方式:Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

来源线索

由仓库数据生成

此页面由 av-webscripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment