LuaRocks

ID

luarocks

Home page

https://luarocks.org

Version requirement

>= 3.9.1

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove

purl types

pkg:luarocks

CLI name

luarocks

Every call

luarocks --no-project <command>

Issues and PRs

📦 manager: luarocks

Source

meta_package_manager/managers/luarocks.py

LuaRocks, the package manager for Lua modules.

A package is a rock, identified by the bare name every listing prints. Its version carries a packaging revision after a dash (3.1.2-0), kept verbatim because that is the form luarocks install accepts back.

Note

Every read passes --porcelain, which replaces the default grouped display with one tab-separated record per line.

Note

Search is what makes this a class rather than a bundled definition. luarocks search prints one row per (rock, version, kind) triple, so a single rock comes back a dozen times over: once per published version, and again for each of the rockspec and src forms it ships in. mpm keys a package on its id alone, so the rows are reduced here to one entry per rock. The installed and outdated listings get the same treatment, LuaRocks being able to hold several versions of a rock in one tree.

Caution

--no-project is load-bearing. LuaRocks walks up from the working directory looking for a project tree and silently switches to it when one is found, so without the flag the inventory would answer for whichever directory mpm happened to be invoked from instead of for the machine. haxelib forces --global against the same hazard.

The flag is a global one, placed before the subcommand, which is why it is declared as pre_args rather than repeated per operation. The version probe skips pre_args entirely and so runs bare.

Caution

Reads and writes disagree about scope, and deliberately so. list reports every configured tree at once, which is the right answer for an inventory of the machine: the system tree and the user’s ~/.luarocks both show up, each row naming the tree holding it. install and remove act on one tree only, the default one, so removing a rock that lives in the other tree fails with Error: Could not find rock 'say' in /opt/homebrew.

That asymmetry is left as LuaRocks defines it rather than papered over. Forcing --local would make the user tree writable at the cost of the system one, and forcing --global the reverse; neither is right for every host, and the failure is loud, immediate and names the tree it searched.

Note

No upgrade --all: LuaRocks has no command updating every installed rock, install being what upgrades a named one in place. mpm backfills the bulk case from outdated plus the per-rock upgrade.

No sync either, nothing refreshing the manifest without also downloading, and no cleanup: luarocks purge empties an entire tree rather than reclaiming anything, which is a mass removal and not a cleanup.

Documentation: LuaRocks documentation.

What mpm adds to luarocks

Through mpm, luarocks gains:

• a one-command upgrade --all that refreshes every outdated package in a single run

• --exact and --extended search, to narrow to exact names or match descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover luarocks alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your luarocks commands, in mpm

You already know luarocks: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With luarocks	With mpm
List what’s installed	luarocks list --porcelain	mpm --luarocks installed
List outdated packages	luarocks list --outdated --porcelain	mpm --luarocks outdated
Search for a package	luarocks search say --porcelain	mpm --luarocks search say
Install a package	luarocks install inspect	mpm install pkg:luarocks/inspect
Upgrade one package	luarocks install inspect	mpm --luarocks upgrade inspect
Upgrade everything	—	mpm --luarocks upgrade --all
Remove a package	luarocks remove inspect	mpm remove pkg:luarocks/inspect

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓	backfilled by mpm
remove	✓
sync
cleanup
doctor

Selecting and configuring luarocks

Deselect luarocks for a single run with --no-luarocks, or persist the choice in your configuration:

[mpm]
luarocks = false

The arguments and environment variables listed in the box atop this page are forced on every luarocks call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.luarocks]
timeout = 900

mpm config-template luarocks prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around luarocks, one mpm command each:

• Snapshot and clone a machine: mpm --luarocks dump luarocks.toml, then mpm restore luarocks.toml on the next one.

• Export a compliance SBOM: mpm --luarocks sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of LuaRocks’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: LuaRocks (pkg:luarocks)

• Retraction: Deletion, not retraction: luarocks.org is the single host and its site application exposes owner and administrator delete paths (modules.moon), with no yank or unlist concept, so a withdrawn version simply stops existing in the manifest

• Publish date: ❌ the manifest the client downloads maps module to version to arch and carries no timestamp of any kind, so a release-age gate would have nothing client-side to filter on

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ luarocks --version
/opt/homebrew/bin/luarocks 3.13.0
LuaRocks main command-line interface

and extracted with:

r"luarocks(?:\.exe)?[ \t]+(?P<version>\d+\.\d+(?:\.\d+)?)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know LuaRocks well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ luarocks --no-project list --porcelain
inspect	3.1.2-0	installed	/Users/kde/.luarocks/lib/luarocks/rocks-5.5
say	1.4.1-3	installed	/Users/kde/.luarocks/lib/luarocks/rocks-5.5

$ luarocks --no-project list --outdated --porcelain
inspect	3.1.2-0	3.1.3-0	https://luarocks.org

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --luarocks installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 7.7.0.dev0 (unreleased)

  • Add LuaRocks package manager, with installed, outdated, search, install, upgrade and remove support. Every call forces --no-project so the inventory answers for the machine rather than for the working directory’s project tree, and search results are reduced to one entry per rock.