Arch Linux pacaur

Warning

pacaur is unmaintained. The original pacaur repository is archived (last commit 2018) and the E5ten fork has had no commits since 2021; migrate to paru or yay.

ID

pacaur

Link

Repository

Upstream stars

⭐ 116

Last commit

2021-04-22

Version requirement

>= 4

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor

purl types

pkg:alpm/ · pkg:pacaur/

CLI name

pacaur

Every call

pacaur --noconfirm --color never <command>

Issues and PRs

📦 manager: pacman-based

Source

pacman.py

AUR helper wrapping pacman, driven through the pacaur binary.

Inherits every operation, parser and forced argument from Pacman; only the binary and version probe differ. Routing through pacaur is what lets --query --upgrades report AUR updates on top of the official repositories.

Unlike pacman, the helper must run as the regular user: it aborts under root (you cannot perform this operation as root) because makepkg refuses to build as root, and it invokes sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

What mpm adds to pacaur

Through mpm, pacaur gains:

• a one-command cleanup --orphans that removes every orphaned dependency at once

• --extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pacaur alongside aura, dkp-pacman, pacman, pamac, paru, pikaur, shelly, trizen, yay and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pacaur commands, in mpm

You already know pacaur: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pacaur	With mpm
List what’s installed	pacman --query	mpm --pacaur installed
List outdated packages	pacman --query --upgrades	mpm --pacaur outdated
Search for a package	pacman --sync --search fire	mpm --pacaur search fire
Install a package	sudo pacman --sync firefox	mpm install pkg:pacaur/firefox
Upgrade one package	sudo pacman --sync firefox	mpm --pacaur upgrade firefox
Upgrade everything	sudo pacman --sync --refresh --sysupgrade	mpm --pacaur upgrade --all
Remove a package	sudo pacman --remove firefox	mpm remove pkg:pacaur/firefox
List orphaned dependencies	pacman --query --deps --unrequired	mpm --pacaur orphans
Clear caches	sudo pacman --sync --clean --clean	mpm --pacaur cleanup --cache
Run health checks	pacman --database --check	mpm --pacaur doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✅
outdated	✅	Only packages tracked in a sync database are reported; foreign packages (AUR builds, -U installs) stay invisible to the plain pacman binary.
orphans	✅
search	✅	Extended search backfilled by mpm.
install	✅	A package already installed as a dependency is marked explicit by mpm.
upgrade	✅
upgrade_all	✅
remove	✅	The --orphans flag also drops the package’s orphaned dependencies.
sync	✅
cleanup	✅	The --orphans sweep is backfilled by mpm.
doctor	✅

Configuration

• Ignore pacaur on the mpm CLI by passing the --no-pacaur option.

• Ignore it for every run in your configuration:

  [mpm]
  pacaur = false
  

• Raise the timeout of all pacaur calls:

  [mpm.overrides.pacaur]
  timeout = 900
  

• Run mpm config-template pacaur to print all overridable settings for your configuration file:

  [mpm.overrides.pacaur]
  cli_names = [
      "pacaur",
  ]
  cli_search_path = []
  dry_run = false
  ignore_auto_updates = true
  plan = false
  post_args = []
  pre_args = [
      "--noconfirm",
      "--color",
      "never",
  ]
  pre_cmds = []
  requirement = ">=4.0.0"
  stop_on_error = false
  unmaintained = true
  version_cli_options = [
      "--version",
  ]
  version_regexes = [
      "pacaur\\s+(?P<version>\\S+)",
  ]
  

The arguments and environment variables listed in the box atop this page are forced on every pacaur call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes

A few jobs you would otherwise script around pacaur, one mpm command each:

• Snapshot and clone a machine: mpm --pacaur dump pacaur.toml, then mpm restore pacaur.toml on the next one.

• Export a compliance SBOM: mpm --pacaur sbom (CycloneDX by default, --spdx for SPDX).

• Gate CI on health: mpm --pacaur doctor relays Arch Linux pacaur’s own diagnosis and exits non-zero on trouble.

Privilege escalation

Arch Linux pacaur runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency

mpm never runs pacaur at the same time as aura, pacman, pamac, paru, pikaur, trizen or yay: they all reach the pacman database (/var/lib/pacman/db.lck), and two of them mutating at once fail to init their transaction. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown

State of Arch Linux pacaur’s release-age gating, from the cooldown support table:

Status: ❌ None (Arch AUR helper)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: AUR

• Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package

• Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay and paru probe gate on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version check

The version is probed by running:

$ pacaur --version
pacaur 4.8.6

and extracted with:

r"pacaur\s+(?P<version>\S+)"

Upstream project

Metrics	E5ten/pacaur
Activity
Popularity
Metadata

Changelog

• 8.0.0 (2026-09-20)

  • Mark a package already installed as a dependency as explicitly installed when mpm install or mpm restore names it, so mpm cleanup --orphans keeps it.

  • Stop running the AUR helpers concurrently with pacman and with each other, all of them driving the same pacman database.

• 7.4.0 (2026-07-25)

  • The AUR helpers are no longer wrapped in sudo: they refuse or break under root (makepkg rejects root builds, paru aborts AUR transactions, pacaur aborts its sync operations) and escalate through their own internal sudo pacman calls, which mpm now tracks with the internal_sudo marker (warm credential-cache keepalive, hidden-prompt watchdog). This also lets yay’s cooldown environment overlay reach the process, where the sudo wrap used to strip it.

• 6.2.0 (2026-03-25)

  • Add --color never option to all invocations.

• 5.9.0 (2022-11-20)

  • Implement pacaur support. Closes #816.