Arch Linux pikaur¶

ID: pikaur
Link: Repository
Upstream stars: ⭐ 958
Last commit: 2026-09-10
Version requirement: >= 1
Platforms: 🅱️ BSD · 🐧 Linux · ⨂ Unix
Operations: installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor
purl types: pkg:alpm/ · pkg:pikaur/
CLI name: pikaur
Every call: pikaur --noconfirm --color never <command>
Issues and PRs: 📦 manager: pacman-based
Source: pacman.py

AUR helper wrapping pacman, driven through the pikaur binary.

Inherits every operation, parser and forced argument from Pacman; the binary, the version probe and the release floor are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories.

Like the other helpers, pikaur must run as the regular user: makepkg refuses to build as root, and pikaur drives sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

Note

pikaur wraps pacman’s options faithfully except --sync --refresh --sysupgrade (-Syu), which it splits into a refresh pass and an upgrade pass so a user can amend the package selection in between. The inherited Pacman.upgrade_all_cli() still builds the combined form, and the --noconfirm forced by Pacman.pre_args is what keeps that split unattended.

What `mpm` adds to `pikaur`¶

Through mpm, pikaur gains:

a one-command cleanup --orphans that removes every orphaned dependency at once
--extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pikaur alongside aura, dkp-pacman, pacaur, pacman, pamac, paru, shelly, trizen, yay and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pikaur` commands, in `mpm`¶

You already know pikaur: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pikaur`	With `mpm`
List what’s installed	`pacman --query`	`mpm --pikaur installed`
List outdated packages	`pacman --query --upgrades`	`mpm --pikaur outdated`
Search for a package	`pacman --sync --search fire`	`mpm --pikaur search fire`
Install a package	`sudo pacman --sync firefox`	`mpm install pkg:pikaur/firefox`
Upgrade one package	`sudo pacman --sync firefox`	`mpm --pikaur upgrade firefox`
Upgrade everything	`sudo pacman --sync --refresh --sysupgrade`	`mpm --pikaur upgrade --all`
Remove a package	`sudo pacman --remove firefox`	`mpm remove pkg:pikaur/firefox`
List orphaned dependencies	`pacman --query --deps --unrequired`	`mpm --pikaur orphans`
Clear caches	`sudo pacman --sync --clean --clean`	`mpm --pikaur cleanup --cache`
Run health checks	`pacman --database --check`	`mpm --pikaur doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅	Only packages tracked in a sync database are reported; foreign packages (AUR builds, `-U` installs) stay invisible to the plain `pacman` binary.
`orphans`	✅
`search`	✅	Extended search backfilled by `mpm`.
`install`	✅	A package already installed as a dependency is marked explicit by `mpm`.
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅	The `--orphans` flag also drops the package’s orphaned dependencies.
`sync`	✅
`cleanup`	✅	The `--orphans` sweep is backfilled by `mpm`.
`doctor`	✅

Configuration¶

Ignore pikaur on the mpm CLI by passing the --no-pikaur option.
Ignore it for every run in your configuration:
```
[mpm]
pikaur = false
```
Raise the timeout of all pikaur calls:
```
[mpm.overrides.pikaur]
timeout = 900
```

Run mpm config-template pikaur to print all overridable settings for your configuration file:

[mpm.overrides.pikaur]
cli_names = [
    "pikaur",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "--noconfirm",
    "--color",
    "never",
]
pre_cmds = []
requirement = ">=1.0.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    ".*Pikaur\\s+v(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every pikaur call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around pikaur, one mpm command each:

Snapshot and clone a machine: mpm --pikaur dump pikaur.toml, then mpm restore pikaur.toml on the next one.
Export a compliance SBOM: mpm --pikaur sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --pikaur doctor relays Arch Linux pikaur’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

Arch Linux pikaur runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency¶

mpm never runs pikaur at the same time as aura, pacaur, pacman, pamac, paru, trizen or yay: they all reach the pacman database (/var/lib/pacman/db.lck), and two of them mutating at once fail to init their transaction. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown¶

State of Arch Linux pikaur’s release-age gating, from the cooldown support table:

Status: ❌ None (Arch AUR helper; could take paru’s probe)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: AUR
Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package
Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay and paru probe gate on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version check¶

The version is extracted from the output of pikaur --version with:

r".*Pikaur\s+v(?P<version>\S+)"

Upstream project¶

Metrics	`actionless/pikaur`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Mark a package already installed as a dependency as explicitly installed when mpm install or mpm restore names it, so mpm cleanup --orphans keeps it.
- Resolve pkg:alpm, pkg:conda, pkg:deb, pkg:melpa, pkg:pypi and pkg:rpm pURLs to these managers too, alongside the ones already handling each type.
- Add the pikaur AUR helper with the full operation set inherited from pacman.
- Stop running the AUR helpers concurrently with pacman and with each other, all of them driving the same pacman database.