Pacstall

ID

pacstall

Home page

https://pacstall.dev

Version requirement

>= 6

Platforms

🐧 Linux

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · sync

purl types

pkg:pacstall

CLI name

pacstall

Forced environment

DISABLE_PROMPTS=1 · NO_COLOR=1

Issues and PRs

📦 manager: dpkg-based

Source

meta_package_manager/managers/pacstall.py

AUR-inspired, source-based package manager for Ubuntu and other Linux distributions.

Pacstall builds packages from “pacscripts” and installs the results as .deb archives through dpkg. mpm forces NO_COLOR and DISABLE_PROMPTS so output is uncolored and every call stays non-interactive.

pacstall self-escalates: every privileged subcommand re-execs the script through sudo pacstall (its elevate() function), and its documented invocation is unprefixed (pacstall -I foo). mpm therefore never wraps it and marks it internal_sudo instead: a warm sudo credential cache is kept alive for its mid-run re-exec, and the hidden-prompt watchdog covers the cold-cache case.

Note

Listing installed packages is a two-step probe: piped --list prints bare names with no versions, so mpm follows each with a --cache-info <pkg> version call to recover its version.

Note

--search matches names only and reports no versions. There is no per-package upgrade verb either, so upgrading one package reinstalls it through --install.

What mpm adds to pacstall

Through mpm, pacstall gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pacstall alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pacstall commands, in mpm

You already know pacstall: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pacstall	With mpm
List what’s installed	pacstall --list	mpm --pacstall installed
List outdated packages	pacstall --list-upgrades	mpm --pacstall outdated
Search for a package	pacstall --search neovim	mpm --pacstall search neovim
Install a package	pacstall --install neofetch	mpm install pkg:pacstall/neofetch
Upgrade one package	pacstall --install neofetch	mpm --pacstall upgrade neofetch
Upgrade everything	pacstall --upgrade	mpm --pacstall upgrade --all
Remove a package	pacstall --remove neofetch	mpm remove pkg:pacstall/neofetch

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync	✓
cleanup
doctor

Selecting and configuring pacstall

Deselect pacstall for a single run with --no-pacstall, or persist the choice in your configuration:

[mpm]
pacstall = false

The arguments and environment variables listed in the box atop this page are forced on every pacstall call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pacstall]
timeout = 900

mpm config-template pacstall prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around pacstall, one mpm command each:

• Snapshot and clone a machine: mpm --pacstall dump pacstall.toml, then mpm restore pacstall.toml on the next one.

• Export a compliance SBOM: mpm --pacstall sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

Pacstall runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Cooldown

State of Pacstall’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Source-based recipe trees

• Retraction: Index revert of the recipe tree

• Publish date: ❌ a recipe carries no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ pacstall --version
6.3.7 Vanilla

and extracted with:

r"(?P<version>\d+\.\d+\.\d+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Pacstall well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pacstall --list
neofetch
neovim

$ pacstall --list-upgrades
Upgradable: 2
    neofetch @ pacstall-programs#master ( 7.1.0-2 -> 7.2.0-1 )
    neovim @ pacstall-programs#master ( 0.9.4-1 -> 0.10.0-1 )

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pacstall installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 7.4.0 (2026-07-25)

  • Marked as internal escalators (internal_sudo): pacstall re-execs itself through sudo pacstall and topgrade runs each privileged step through its own sudo, so mpm never wraps them, keeps a warm credential cache alive for their mid-run escalations, and watches for hidden password prompts.

• 6.3.0 (2026-04-09)

  • Add Pacstall package manager with installed, outdated, search, install, upgrade, remove, and sync support. Closes #1610.