Arch Linux pikaur¶

ID: pikaur
Home page: https://github.com/actionless/pikaur
Version requirement: >= 1
Platforms: 🅱️ BSD · 🐧 Linux · ⨂ Unix
Operations: installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor
purl types: pkg:pikaur
CLI name: pikaur
Every call: pikaur --noconfirm --color never <command>
Issues and PRs: 📦 manager: pacman-based
Source: meta_package_manager/managers/pacman.py

AUR helper wrapping pacman, driven through the pikaur binary.

Inherits every operation, parser and forced argument from Pacman; the binary, the version probe and the release floor are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories.

Like the other helpers, pikaur must run as the regular user: makepkg refuses to build as root, and pikaur drives sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

Note

pikaur wraps pacman’s options faithfully except --sync --refresh --sysupgrade (-Syu), which it splits into a refresh pass and an upgrade pass so a user can amend the package selection in between. The inherited Pacman.upgrade_all_cli() still builds the combined form, and the --noconfirm forced by Pacman.pre_args is what keeps that split unattended.

Documentation: pikaur.

What `mpm` adds to `pikaur`¶

Through mpm, pikaur gains:

a one-command cleanup --orphans that removes every orphaned dependency at once
--extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pikaur alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pikaur` commands, in `mpm`¶

You already know pikaur: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pikaur`	With `mpm`
List what’s installed	`pacman --query`	`mpm --pikaur installed`
List outdated packages	`pacman --query --upgrades`	`mpm --pikaur outdated`
Search for a package	`pacman --sync --search fire`	`mpm --pikaur search fire`
Install a package	`sudo pacman --sync firefox`	`mpm install pkg:pikaur/firefox`
Upgrade one package	`sudo pacman --sync firefox`	`mpm --pikaur upgrade firefox`
Upgrade everything	`sudo pacman --sync --refresh --sysupgrade`	`mpm --pikaur upgrade --all`
Remove a package	`sudo pacman --remove firefox`	`mpm remove pkg:pikaur/firefox`
List orphaned dependencies	`pacman --query --deps --unrequired`	`mpm --pikaur orphans`
Clear caches	`sudo pacman --sync --clean --clean`	`mpm --pikaur cleanup --cache`
Run health checks	`pacman --database --check`	`mpm --pikaur doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`	✓
`search`	✓	extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓	`--orphans` also drops the package’s orphaned dependencies
`sync`	✓
`cleanup`	✓	`--orphans` sweep backfilled by `mpm`
`doctor`	✓

Selecting and configuring `pikaur`¶

Deselect pikaur for a single run with --no-pikaur, or persist the choice in your configuration:

[mpm]
pikaur = false

The arguments and environment variables listed in the box atop this page are forced on every pikaur call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pikaur]
timeout = 900

mpm config-template pikaur prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around pikaur, one mpm command each:

Snapshot and clone a machine: mpm --pikaur dump pikaur.toml, then mpm restore pikaur.toml on the next one.
Export a compliance SBOM: mpm --pikaur sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --pikaur doctor relays Arch Linux pikaur’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

Arch Linux pikaur runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Cooldown¶

Not yet assessed in the cooldown support table.

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: AUR
Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package
Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay gates on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is extracted from the output of pikaur --version with:

r".*Pikaur\s+v(?P<version>\S+)"

Changelog¶

7.7.0.dev0 (unreleased)
- Add the pikaur AUR helper with the full operation set inherited from pacman.