bin¶

ID: bin
Link: Repository
Upstream stars: ⭐ 1,298
Last commit: 2026-09-26
Version requirement: >= 0.27
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · upgrade · upgrade_all · remove
purl types: pkg:bin/
CLI name: bin
Forced environment: NO_COLOR=1
Issues and PRs: 📦 manager: bin
Source: bin.py

Installer of binaries straight from GitHub releases and similar sources.

Caution

The package identifier is the absolute path of the installed binary, which is what the listing reports and what remove and update accept. A source spec (github.com/junegunn/fzf, a release-tag URL, goinstall://…) does not resolve outside the install command itself.

Caution

A bin that has never been configured prompts for its download directory on every command and cannot be driven until someone answers once interactively. Until then mpm treats the manager as unavailable rather than reporting zero packages.

No escalation is ever needed: bin installs into a directory it picked from $PATH for being writable.

What `mpm` adds to `bin`¶

mpm reaches across every manager at once, not bin alone: mpm installed and mpm outdated cover bin alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `bin` commands, in `mpm`¶

You already know bin: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `bin`	With `mpm`
List what’s installed	`bin list`	`mpm --bin installed`
List outdated packages	`bin update --dry-run`	`mpm --bin outdated`
Upgrade one package	`bin update --yes --continue-on-error /home/user/.local/bin/fzf`	`mpm --bin upgrade /home/user/.local/bin/fzf`
Upgrade everything	`bin update --yes --continue-on-error`	`mpm --bin upgrade --all`
Remove a package	`bin remove /home/user/.local/bin/fzf`	`mpm remove pkg:bin//home/user/.local/bin/fzf`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅
`orphans`
`search`	❌	There is no registry to search, only sources the user names.
`install`	❌	No identifier the listing reports can be handed back to the install command, which takes a source spec.
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`	❌	There is no index to refresh.
`cleanup`
`doctor`

Configuration¶

Ignore bin on the mpm CLI by passing the --no-bin option.
Ignore it for every run in your configuration:
```
[mpm]
bin = false
```
Raise the timeout of all bin calls:
```
[mpm.overrides.bin]
timeout = 900
```

Run mpm config-template bin to print all overridable settings for your configuration file:

[mpm.overrides.bin]
cli_names = [
    "bin",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=0.27.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "^bin version (?P<version>\\S+)",
]

[mpm.overrides.bin.extra_env]
NO_COLOR = "1"

The arguments and environment variables listed in the box atop this page are forced on every bin call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around bin, one mpm command each:

Snapshot and clone a machine: mpm --bin dump bin.toml, then mpm restore bin.toml on the next one.
Export a compliance SBOM: mpm --bin sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of bin’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: GitHub release assets
Retraction: None: withdrawing a build is the upstream author deleting their own release or tag. Nothing sits between them and the user
Publish date: ✅ server-set published_at on each release (REST API)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know bin well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ bin list
/home/user/.local/bin/fzf         v0.74.2  github.com/junegunn/fzf                                    OK
/home/user/.local/bin/rg          14.1.1   https://github.com/BurntSushi/ripgrep/releases/tag/14.1.1  OK
/home/user/.local/bin/terraform  *1.5.7    releases.hashicorp.com/terraform                           OK

Version check¶

The version is probed by running:

$ bin --version
bin version 0.29.1
commit: c24db4aced89c855062fe8e2907ae0deb3fb9f53
built at: 2026-08-02T13:37:10Z
built by: goreleaser

and extracted with:

r"^bin version (?P<version>\S+)"

Upstream project¶

Metrics	`marcosnils/bin`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Add the bin binary manager with installed, outdated, upgrade and remove support, keyed on the installed binary’s absolute path. It declares no install, since bin installs from a source spec no listing reports back.