LURE¶

Note

LURE’s own forge at git.elara.ws answers 502 and lure.sh answers 404 behind a placeholder certificate, so its installer and release binaries are both unreachable and the tool has to be built from source. Its author announced a pause rather than an end in lure-sh/lure#89 on 2025-05-04, “I intend to start working on it again as soon as I’m in a stable position again”, and the recipe repository this manager reads is on GitHub and still moving.

ID: lure
Home page: https://github.com/lure-sh/lure
Version requirement: >= 0.1.3
Platforms: 🐧 Linux
Operations: installed · search · install · sync
purl types: pkg:lure
CLI name: lure
Issues and PRs: 📦 manager: lure
Source: meta_package_manager/managers/lure.py

LURE, the Linux User REpository: an AUR-shaped build system for any distro.

A package is a build recipe in a git repository LURE clones, and the resulting artifact is handed to the host’s own package manager, so LURE reaches packages no distro archive carries while leaving the installed state with apt, dnf, pacman or whichever backend the host runs.

Important

LURE escalates itself and refuses to be escalated. It aborts as root with “Running LURE as root is forbidden as it may cause catastrophic damage to your system”, and calls its own configured RootCmd (sudo by default) for the privileged half. mpm therefore marks nothing here privileged, the same treatment chromebrew gets.

Caution

remove and upgrade are absent, and the reason is one field. LURE’s default backend options set NoConfirm: false, and only its build path flips it true, so an install reaches the backend as apt install -y while a removal reaches it as a bare apt remove and blocks forever on a confirmation prompt no mpm run can answer. --pm-args can push a flag through, but the right flag is the backend’s own: -y suits apt, dnf and zypper, while pacman reads -y as refresh the databases, so there is no value mpm could pass without knowing a backend it cannot resolve.

Note

Every subcommand pulls its repositories before doing anything else, so even a listing costs a network round-trip and prints the git progress on <stderr>. Only the packages themselves reach <stdout>.

Documentation: LURE readme.

What `mpm` adds to `lure`¶

Through mpm, lure gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover lure alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `lure` commands, in `mpm`¶

You already know lure: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `lure`	With `mpm`
List what’s installed	`lure list --installed`	`mpm --lure installed`
Search for a package	`lure list`	`mpm --lure search list`
Install a package	`lure install neofetch`	`mpm install pkg:lure/neofetch`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`
`orphans`
`search`	✓	exact and extended search backfilled by `mpm`
`install`	✓
`upgrade`
`upgrade_all`
`remove`
`sync`	✓
`cleanup`
`doctor`

Selecting and configuring `lure`¶

Deselect lure for a single run with --no-lure, or persist the choice in your configuration:

[mpm]
lure = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.lure]
timeout = 900

mpm config-template lure prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around lure, one mpm command each:

Snapshot and clone a machine: mpm --lure dump lure.toml, then mpm restore lure.toml on the next one.
Export a compliance SBOM: mpm --lure sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of LURE’s release-age gating, from the cooldown support table:

Status: ❌ None (a package is a build recipe in a git repository, carrying no publication date)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: LURE recipe repositories
Retraction: Repository edit: a package is a recipe in a git repository LURE tracks, so it is withdrawn by that repository dropping the recipe
Publish date: ❌ a recipe records a version but no date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ lure version
v0.1.3

and extracted with:

r"v?(?P<version>\d+\.\d+\.\d+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know LURE well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ lure list --installed
default/neofetch 7.1.0-1

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --lure installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add LURE package manager, with inventory, catalog search, install and repository refresh.