Nala¶

ID: nala
Home page: https://gitlab.com/volian/nala
Version requirement: >= 0.12.2
Platforms: 🐧 Linux (except Windows Subsystem for Linux v1, Windows Subsystem for Linux v2)
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · sync · cleanup
purl types: pkg:nala
CLI name: nala
Forced environment: LC_ALL=C
Issues and PRs: 📦 manager: nala
Source: meta_package_manager/managers/nala.py

Front-end to Debian’s apt, driving libapt-pkg directly.

Nala reaches the same archives apt does, adding a parallel downloader, a mirror-scoring fetcher and a transaction history it can roll back. It is wrapped on the same grounds as the AUR helpers that sit over pacman: a distinct tool with a vocabulary of its own, rather than a translation layer over another CLI. It shares dpkg’s lock with the rest of that family, so mpm runs it serially against them.

Important

Every invocation forces LC_ALL=C, and it is doing two jobs at once. Nala translates its own output at runtime, so a French host reports est installé where the parsers expect is installed; and it picks its tree glyphs from the encoding of its output stream. The same flag that pins the language to the untranslated strings also selects the ASCII glyphs, giving one stable shape to parse instead of a matrix of locale and encoding.

Caution

A listing is a record of three lines, not a line per package: a header naming the package and its version, a branch giving its status, and another carrying its description. That is why this is a class rather than a declarative definition, and why outdated correlates two lines to pair an installed version with the candidate it can move to.

Note

Nala’s own upgrade takes no package arguments at all, accepting only exclusions, so naming a package cannot restrict it. Upgrading one package therefore goes through install, which moves an already-installed package to its candidate version, exactly as apt does.

Documentation: nala.

What `mpm` adds to `nala`¶

Through mpm, nala gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover nala alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `nala` commands, in `mpm`¶

You already know nala: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `nala`	With `mpm`
List what’s installed	`nala list --installed`	`mpm --nala installed`
List outdated packages	`nala list --upgradable`	`mpm --nala outdated`
Search for a package	`nala search vim`	`mpm --nala search vim`
Install a package	`sudo nala install --assume-yes firefox`	`mpm install pkg:nala/firefox`
Upgrade one package	`sudo nala install --assume-yes firefox`	`mpm --nala upgrade firefox`
Upgrade everything	`sudo nala upgrade --assume-yes`	`mpm --nala upgrade --all`
Remove a package	`sudo nala remove --assume-yes firefox`	`mpm remove pkg:nala/firefox`
Clear caches	`sudo nala clean`	`mpm --nala cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact and extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`	✓	`--orphans` runs the system-wide orphan sweep
`doctor`

Selecting and configuring `nala`¶

Deselect nala for a single run with --no-nala, or persist the choice in your configuration:

[mpm]
nala = false

The arguments and environment variables listed in the box atop this page are forced on every nala call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.nala]
timeout = 900

mpm config-template nala prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around nala, one mpm command each:

Snapshot and clone a machine: mpm --nala dump nala.toml, then mpm restore nala.toml on the next one.
Export a compliance SBOM: mpm --nala sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Nala’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)
Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)
Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ nala --version
nala 0.16.0

and extracted with:

r"nala\s+(?P<version>\S+)"

Changelog¶

7.7.0.dev0 (unreleased)
- Add the Nala front-end to Debian’s apt with installed, outdated, search, install, upgrade, remove, sync and cleanup support. Every call forces LC_ALL=C, which pins its runtime-translated output to the strings the parsers expect and selects its ASCII tree glyphs at once. It joins the dpkg lock family, and its per-package upgrade routes through install, nala’s own upgrade accepting no package arguments.