Arch Linux paru¶

ID: paru
Home page: https://github.com/Morganamilo/paru
Upstream stars: ⭐ 8,973
Last commit: 2026-01-09
Version requirement: >= 1.9.3
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · ⨂ Unix
Operations: installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor
purl types: pkg:alpm · pkg:paru
CLI name: paru
Every call: paru --noconfirm --color never <command>
Issues and PRs: 📦 manager: pacman-based
Source: meta_package_manager/managers/pacman.py

AUR helper wrapping pacman, driven through the paru binary.

Inherits every operation, parser and forced argument from Pacman; only the binary and version probe differ. Its own --query --upgrades reports AUR updates on top of the official repositories. The >=1.9.3 floor is the first paru release to implement --sysupgrade, the flag the inherited upgrade_all_cli builds.

Unlike pacman, the helper must run as the regular user: any transaction building AUR packages aborts under root (can't install AUR package as root), and paru invokes sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

What `mpm` adds to `paru`¶

Through mpm, paru gains:

a one-command cleanup --orphans that removes every orphaned dependency at once
--extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover paru alongside aura, pacaur, pacman, pamac, shelly, yay and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `paru` commands, in `mpm`¶

You already know paru: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `paru`	With `mpm`
List what’s installed	`pacman --query`	`mpm --paru installed`
List outdated packages	`pacman --query --upgrades`	`mpm --paru outdated`
Search for a package	`pacman --sync --search fire`	`mpm --paru search fire`
Install a package	`sudo pacman --sync firefox`	`mpm install pkg:paru/firefox`
Upgrade one package	`sudo pacman --sync firefox`	`mpm --paru upgrade firefox`
Upgrade everything	`sudo pacman --sync --refresh --sysupgrade`	`mpm --paru upgrade --all`
Remove a package	`sudo pacman --remove firefox`	`mpm remove pkg:paru/firefox`
List orphaned dependencies	`pacman --query --deps --unrequired`	`mpm --paru orphans`
Clear caches	`sudo pacman --sync --clean --clean`	`mpm --paru cleanup --cache`
Run health checks	`pacman --database --check`	`mpm --paru doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`	✓
`search`	✓	extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓	`--orphans` also drops the package’s orphaned dependencies
`sync`	✓
`cleanup`	✓	`--orphans` sweep backfilled by `mpm`
`doctor`	✓

Selecting and configuring `paru`¶

Deselect paru for a single run with --no-paru, or persist the choice in your configuration:

[mpm]
paru = false

The arguments and environment variables listed in the box atop this page are forced on every paru call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.overrides.paru]
timeout = 900

mpm config-template paru prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around paru, one mpm command each:

Snapshot and clone a machine: mpm --paru dump paru.toml, then mpm restore paru.toml on the next one.
Export a compliance SBOM: mpm --paru sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --paru doctor relays Arch Linux paru’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

Arch Linux paru runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency¶

mpm never runs paru at the same time as aura, pacaur, pacman, pamac, pikaur, trizen or yay: they all reach the pacman database (/var/lib/pacman/db.lck), and two of them mutating at once fail to init their transaction. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown¶

mpm enforces its release-age cooldown on Arch Linux paru with its own per-package probe: before an install or upgrade, it reads the publication date of the package’s latest release and holds back any release younger than the window (mpm --cooldown 7 --paru upgrade --all skips anything published in the last 7 days): a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced (mpm per-package probe, AUR half)
Mechanism: AUR LastModified read by paru --sync --info; held packages ride --ignore
Reference: AUR RPC

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: AUR
Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package
Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay and paru probe gate on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

Version probe¶

The version is probed by running:

$ paru --version
paru v1.10.0 - libalpm v13.0.1

and extracted with:

r"paru\s+v(?P<version>\S+)"

Upstream project¶

Metrics	`Morganamilo/paru`
Activity
Popularity
Metadata

Changelog¶

8.0.0.dev0 (unreleased)
- Gate paru’s AUR half under --cooldown: too-fresh AUR packages, dated by the RPC’s LastModified, are held out of the --sysupgrade transaction with --ignore while official-repository packages pass untouched.
- Stop running the AUR helpers concurrently with pacman and with each other. All of them drive the same pacman database, either by shelling out to sudo pacman or, for pamac, through Manjaro’s own libalpm binding, so two mutating at once failed to init their transaction.
7.4.0 (2026-07-25)
- The AUR helpers are no longer wrapped in sudo: they refuse or break under root (makepkg rejects root builds, paru aborts AUR transactions, pacaur aborts its sync operations) and escalate through their own internal sudo pacman calls, which mpm now tracks with the internal_sudo marker (warm credential-cache keepalive, hidden-prompt watchdog). This also lets yay’s cooldown environment overlay reach the process, where the sudo wrap used to strip it.
6.2.0 (2026-03-25)
- Add --color never option to all invocations.
5.3.0 (2022-06-25)
- Add paru support.
- Run install, upgrade, remove and cleanup operations with sudo.