gup¶

ID: gup
Home page: https://github.com/nao1215/gup
Version requirement: >= 1.3.1
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · upgrade · upgrade_all · remove
purl types: pkg:gup
CLI name: gup
Issues and PRs: 📦 manager: go-based
Source: meta_package_manager/managers/gup.toml

gup updates and removes the binaries go install leaves under $GOBIN (https://github.com/nao1215/gup).

A package is the binary name. It is what the listing reports first, what remove and update accept, and what gup itself prints when it tells the user how to update one. The module path sits beside it in every record, and no verb takes it.

Note

gup covers the same binaries go lists, and both are wrapped on purpose: the Go toolchain has no removal verb in any scope and reports no staleness, so remove, outdated and upgrade are reachable through gup alone. A host carrying both therefore reports every Go command twice, under two ids, go keying on the module path and gup on the binary name.

Parsing notes, verified against gup 1.8.1 on macOS:

Both queries read --json, a flat top-level array whose field names upstream commits to in cmd/jsonout.go: “The field names are part of the public contract documented in the README.”
check reports every binary, with a status of up-to-date or update-available, and --quiet trims the text output alone rather than the JSON. Nothing filters it here: mpm’s own refiltered_outdated drops the entries whose two versions match, which is what that filter is for.
remove refuses wherever stdin is not a terminal, answering gup remove requires confirmation, but stdin is not a TTY, so --force is passed.
update takes binary names as positionals, which its own usage line omits: gup update [flags] is what the help documents, and gup update zvm runs.
Versions carry the v the Go module proxy reports, v1.8.1 rather than 1.8.1.
No install, gup installing nothing it was not already given: go install is what creates a binary, and import only replays a manifest. No search either, gup owning no catalog of its own.

Caution

check and update shell out to the Go toolchain and fail loudly without it, answering you didn't install golang. The listing reads the binaries themselves and needs nothing, which upstream settled in 1.7.1: “don’t require the go command for local-only work”.

What `mpm` adds to `gup`¶

mpm reaches across every manager at once, not gup alone: mpm installed and mpm outdated cover gup alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `gup` commands, in `mpm`¶

You already know gup: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `gup`	With `mpm`
List what’s installed	`gup list --json`	`mpm --gup installed`
List outdated packages	`gup check --json`	`mpm --gup outdated`
Upgrade one package	`gup update <package_id>`	`mpm --gup upgrade <package_id>`
Upgrade everything	`gup update`	`mpm --gup upgrade --all`
Remove a package	`gup remove --force <package_id>`	`mpm remove pkg:gup/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`
`install`
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `gup`¶

Deselect gup for a single run with --no-gup, or persist the choice in your configuration:

[mpm]
gup = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.gup]
timeout = 900

mpm config-template gup prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around gup, one mpm command each:

Snapshot and clone a machine: mpm --gup dump gup.toml, then mpm restore gup.toml on the next one.
Export a compliance SBOM: mpm --gup sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of gup’s release-age gating, from the cooldown support table:

Status: ❌ None (Go module proxy, no publication-date filter)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Go module proxy (pkg:golang)
Retraction: Retraction marker: a version stays served forever, the proxy being an immutable cache, so it is withdrawn by the author adding a retract directive to a newer go.mod that clients then skip
Publish date: ❌ no CLI surface prints one, though the proxy does serve a per-version .info timestamp

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ gup version
gup version v1.8.1 (under Apache License version 2.0)

and extracted with:

r"gup\s+version\s+v?(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know gup well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ gup list --json
[
  {
    "name": "gup",
    "import_path": "github.com/nao1215/gup",
    "module_path": "github.com/nao1215/gup",
    "channel": "latest",
    "current_version": "v1.8.1",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  },
  {
    "name": "hello",
    "import_path": "golang.org/x/example/hello",
    "module_path": "golang.org/x/example/hello",
    "channel": "latest",
    "current_version": "v0.0.0-20250915201037-7f05d217867b",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  },
  {
    "name": "zvm",
    "import_path": "github.com/tristanisham/zvm",
    "module_path": "github.com/tristanisham/zvm",
    "channel": "latest",
    "current_version": "v0.8.29",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  }
]

$ gup check --json
[
  {
    "name": "gup",
    "import_path": "github.com/nao1215/gup",
    "module_path": "github.com/nao1215/gup",
    "channel": "latest",
    "current_version": "v1.8.1",
    "latest_version": "v1.8.1",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "up-to-date"
  },
  {
    "name": "hello",
    "import_path": "golang.org/x/example/hello",
    "module_path": "golang.org/x/example/hello",
    "channel": "latest",
    "current_version": "v0.0.0-20250915201037-7f05d217867b",
    "latest_version": "v0.0.0-20250915201037-7f05d217867b",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "up-to-date"
  },
  {
    "name": "zvm",
    "import_path": "github.com/tristanisham/zvm",
    "module_path": "github.com/tristanisham/zvm",
    "channel": "latest",
    "current_version": "v0.8.29",
    "latest_version": "v0.9.1",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "update-available"
  }
]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --gup installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add gup package manager, reporting, removing and upgrading the binaries go install leaves under $GOBIN.