bpkg¶

ID: bpkg
Links: Home page · Repository
Upstream stars: ⭐ 1,976
Last commit: 2023-09-19
Platforms: 🐧 Linux · 🍎 macOS
Operations: install
purl types: pkg:bpkg/
CLI name: bpkg
Issues and PRs: 📦 manager: bash-based
Source: bpkg.toml

bpkg is a lightweight package manager for bash, installing scripts and libraries straight from their Git repositories.

Parsing notes, verified against bpkg 1.1.4 on macOS:

install forces --global. Without it bpkg vendors the package into a deps/ directory relative to the working directory, which is a project operation rather than a machine-wide one.
Only install is declared, and nothing is parsed, which is why no sample beyond the version probe appears below. bpkg exposes no inventory of what it has installed and no removal verb at all: its fourteen commands are getdeps, init, install, json, list, package, realpath, run, show, source, suggest, term, update and utils. That still clears the bar an inventory-less tool has to meet, since a per-package install reaches a package no competitor does.
list is deliberately not mapped to a search. It prints the remote catalogue rather than what is installed, and needs bpkg update to have synced an index first, which fails out of the box: update passes the unset BPKG_CURL_AUTH_PARAM through as an empty argument, so curl refuses with “option : blank argument where content is expected” and the index is never written. Declaring a search that always answers nothing would be worse than declaring none, mpm resolving an install’s candidate manager by searching.
Like clib, the catalogue behind list is a GitHub wiki page rather than a package index.

What `mpm` adds to `bpkg`¶

mpm reaches across every manager at once, not bpkg alone: mpm installed and mpm outdated cover bpkg alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations¶

Operation	Supported
`installed`
`outdated`
`orphans`
`search`
`install`	✅
`upgrade`
`upgrade_all`
`remove`
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore bpkg on the mpm CLI by passing the --no-bpkg option.
Ignore it for every run in your configuration:
```
[mpm]
bpkg = false
```
Raise the timeout of all bpkg calls:
```
[mpm.overrides.bpkg]
timeout = 900
```

Run mpm config-template bpkg to print all overridable settings for your configuration file:

[mpm.overrides.bpkg]
cli_names = [
    "bpkg",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "^(?P<version>\\d+\\.\\d+\\.\\d+)",
]

Recipes¶

A few jobs you would otherwise script around bpkg, one mpm command each:

Snapshot and clone a machine: mpm --bpkg dump bpkg.toml, then mpm restore bpkg.toml on the next one.
Export a compliance SBOM: mpm --bpkg sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of bpkg’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Git repositories (bash)
Retraction: Upstream deletion: bpkg clones the owner/repo it is given straight from the forge, so there is no index standing between the name and the code and no retraction surface either; a package is withdrawn by its repository being deleted, renamed or made private
Publish date: ❌ nothing dates a release: the fetch resolves a branch or tag on the repository rather than a published artefact, so the only timestamp available is a commit date, which is client-set

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version check¶

The version is probed by running:

$ bpkg --version
1.1.4

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+)"

Upstream project¶

Metrics	`bpkg/bpkg`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Add the bpkg Bash package manager with install support, forced --global. It exposes no inventory and no removal verb.