Pacstall

ID

pacstall

Home page

https://pacstall.dev

Upstream stars

⭐ 1,647

Last commit

2026-08-08

Version requirement

>= 6

Platforms

🐧 Linux

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · sync

purl types

pkg:pacstall

CLI name

pacstall

Forced environment

DISABLE_PROMPTS=1
NO_COLOR=1

Issues and PRs

📦 manager: dpkg-based

Source

meta_package_manager/managers/pacstall.py

AUR-inspired, source-based package manager for Ubuntu and other Linux distributions.

Pacstall builds packages from “pacscripts” and installs the results as .deb archives through dpkg. mpm forces NO_COLOR and DISABLE_PROMPTS so output is uncolored and every call stays non-interactive.

pacstall self-escalates: every privileged subcommand re-execs the script through sudo pacstall (its elevate() function), and its documented invocation is unprefixed (pacstall -I foo). mpm therefore never wraps it and marks it internal_sudo instead: a warm sudo credential cache is kept alive for its mid-run re-exec, and the hidden-prompt watchdog covers the cold-cache case.

Note

Listing installed packages is a two-step probe: piped --list prints bare names with no versions, so mpm follows each with a --cache-info <pkg> version call to recover its version.

Note

--search matches names only and reports no versions. There is no per-package upgrade verb either, so upgrading one package reinstalls it through --install.

What mpm adds to pacstall

Through mpm, pacstall gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pacstall alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pacstall commands, in mpm

You already know pacstall: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pacstall	With mpm
List what’s installed	pacstall --list	mpm --pacstall installed
List outdated packages	pacstall --list-upgrades	mpm --pacstall outdated
Search for a package	pacstall --search neovim	mpm --pacstall search neovim
Install a package	pacstall --install neofetch	mpm install pkg:pacstall/neofetch
Upgrade one package	pacstall --install neofetch	mpm --pacstall upgrade neofetch
Upgrade everything	pacstall --upgrade	mpm --pacstall upgrade --all
Remove a package	pacstall --remove neofetch	mpm remove pkg:pacstall/neofetch

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync	✓
cleanup
doctor

Selecting and configuring pacstall

Deselect pacstall for a single run with --no-pacstall, or persist the choice in your configuration:

[mpm]
pacstall = false

The arguments and environment variables listed in the box atop this page are forced on every pacstall call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pacstall]
timeout = 900

mpm config-template pacstall prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around pacstall, one mpm command each:

• Snapshot and clone a machine: mpm --pacstall dump pacstall.toml, then mpm restore pacstall.toml on the next one.

• Export a compliance SBOM: mpm --pacstall sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

Pacstall runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency

mpm never runs pacstall at the same time as apt, apt-mint, deb-get or nala: they all install through dpkg and serialize on its /var/lib/dpkg/lock. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown

State of Pacstall’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Source-based recipe trees

• Retraction: Index revert of the recipe tree

• Publish date: ❌ a recipe carries no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ pacstall --version
6.3.7 Vanilla

and extracted with:

r"(?P<version>\d+\.\d+\.\d+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Pacstall well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pacstall --list
neofetch
neovim

$ pacstall --list-upgrades
Upgradable: 2
    neofetch @ pacstall-programs#master ( 7.1.0-2 -> 7.2.0-1 )
    neovim @ pacstall-programs#master ( 0.9.4-1 -> 0.10.0-1 )

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pacstall installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project

Metrics	pacstall/pacstall
Activity
Popularity
Metadata

Changelog

• 8.0.0.dev0 (unreleased)

  • Serialize pacstall against the apt family rather than against pacman. It builds its pacscripts into .deb archives and installs them through dpkg, so it contends for dpkg’s lock and never touches pacman’s.

• 7.4.0 (2026-07-25)

  • Marked as internal escalators (internal_sudo): pacstall re-execs itself through sudo pacstall and topgrade runs each privileged step through its own sudo, so mpm never wraps them, keeps a warm credential cache alive for their mid-run escalations, and watches for hidden password prompts.

• 6.3.0 (2026-04-09)

  • Add Pacstall package manager with installed, outdated, search, install, upgrade, remove, and sync support. Closes #1610.