bpkg

ID

bpkg

Home page

https://www.bpkg.sh

Platforms

🐧 Linux · 🍎 macOS

Operations

install

purl types

pkg:bpkg

CLI name

bpkg

Issues and PRs

📦 manager: bpkg

Source

meta_package_manager/managers/bpkg.toml

bpkg is a lightweight package manager for bash, installing scripts and libraries straight from their Git repositories.

Parsing notes, verified against bpkg 1.1.4 on macOS:

• install forces --global. Without it bpkg vendors the package into a deps/ directory relative to the working directory, which is a project operation rather than a machine-wide one.

• Only install is declared, and nothing is parsed, which is why no sample beyond the version probe appears below. bpkg exposes no inventory of what it has installed and no removal verb at all: its fourteen commands are getdeps, init, install, json, list, package, realpath, run, show, source, suggest, term, update and utils. That still clears the bar an inventory-less tool has to meet, since a per-package install reaches a package no competitor does.

• list is deliberately not mapped to a search. It prints the remote catalogue rather than what is installed, and needs bpkg update to have synced an index first, which fails out of the box: update passes the unset BPKG_CURL_AUTH_PARAM through as an empty argument, so curl refuses with “option : blank argument where content is expected” and the index is never written. Declaring a search that always answers nothing would be worse than declaring none, mpm resolving an install’s candidate manager by searching.

• Like clib, the catalogue behind list is a GitHub wiki page rather than a package index.

What mpm adds to bpkg

mpm reaches across every manager at once, not bpkg alone: mpm installed and mpm outdated cover bpkg alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations

Operation	Supported
installed
outdated
orphans
search
install	✓
upgrade
upgrade_all
remove
sync
cleanup
doctor

Selecting and configuring bpkg

Deselect bpkg for a single run with --no-bpkg, or persist the choice in your configuration:

[mpm]
bpkg = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.bpkg]
timeout = 900

mpm config-template bpkg prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around bpkg, one mpm command each:

• Snapshot and clone a machine: mpm --bpkg dump bpkg.toml, then mpm restore bpkg.toml on the next one.

• Export a compliance SBOM: mpm --bpkg sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown

State of bpkg’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Git repositories (bash)

• Retraction: Upstream deletion: bpkg clones the owner/repo it is given straight from the forge, so there is no index standing between the name and the code and no retraction surface either; a package is withdrawn by its repository being deleted, renamed or made private

• Publish date: ❌ nothing dates a release: the fetch resolves a branch or tag on the repository rather than a published artefact, so the only timestamp available is a commit date, which is client-set

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ bpkg --version
1.1.4

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+)"

Changelog

• 8.0.0.dev0 (unreleased)

  • Add bpkg package manager as a bundled definition, with install support. install forces --global, without which bpkg vendors the package into a deps/ directory relative to the working directory. It exposes no inventory and no removal verb, and its catalogue read is left unmapped because bpkg update cannot sync an index.