pkgit

ID

pkgit

Home page

https://git.symlinx.net/pkgit

Version requirement

>= 1.2

Platforms

🐧 Linux

Operations

installed · search · install · upgrade_all

purl types

pkg:pkgit

CLI name

pkgit

Issues and PRs

📦 manager: pkgit

Source

meta_package_manager/managers/pkgit.py

pkgit, which compiles and installs packages straight from git repositories.

A package is a git repository the user declares in ~/.config/pkgit/init.lua, which pkgit clones and builds through the repository’s own bldit.lua recipe. That configuration is the registry: pkgit reaches no catalog of its own and fronts no other package manager, so it is wrapped on its own terms rather than declined as a translation layer.

Note

The configuration is mandatory, and its absence is what makes an unconfigured pkgit correctly undetectable: every subcommand, --version included, exits 1 with cannot run configuration script, so the version probe finds nothing and mpm reports the manager unavailable until make defconfig has run.

Caution

remove is deliberately absent. pkgit --remove <package> aborts on a package declared in init.lua, with 'repositories' is not a table. followed by PANIC: unprotected error in call to Lua API (attempt to index a nil value), exiting 1 and leaving the package installed. It succeeds only on a repository pulled in as a build dependency, and even then leaves the checkout behind so installed() keeps reporting it.

Note

A listing carries no version. pkgit enumerates the directories under its share tree, one per cloned repository, and a package is whatever HEAD currently points at, so there is nothing to report as an installed version. Build dependencies are cloned as packages too and appear alongside what was asked for.

Documentation: pkgit README.

What mpm adds to pkgit

Through mpm, pkgit gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pkgit alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pkgit commands, in mpm

You already know pkgit: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pkgit	With mpm
List what’s installed	pkgit --list	mpm --pkgit installed
Search for a package	pkgit --search pkgit	mpm --pkgit search <pkg>
Install a package	pkgit --install pkgit	mpm install pkg:pkgit/<pkg>
Upgrade everything	pkgit --update	mpm --pkgit upgrade --all

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade
upgrade_all	✓
remove
sync
cleanup
doctor

Selecting and configuring pkgit

Deselect pkgit for a single run with --no-pkgit, or persist the choice in your configuration:

[mpm]
pkgit = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pkgit]
timeout = 900

mpm config-template pkgit prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around pkgit, one mpm command each:

• Snapshot and clone a machine: mpm --pkgit dump pkgit.toml, then mpm restore pkgit.toml on the next one.

• Export a compliance SBOM: mpm --pkgit sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of pkgit’s release-age gating, from the cooldown support table:

Status: ❌ None (a package is a git checkout, carrying no version or date)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: pkgit repositories

• Retraction: Repository deletion: a package is a git repository named in the user’s own init.lua, so it is withdrawn by that repository disappearing or dropping its bldit.lua recipe

• Publish date: ❌ a checkout is identified by HEAD alone, so there is nothing to date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe

The version is probed by running:

$ pkgit --version
1.2.0

and extracted with:

r"(?P<version>\d+\S*)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know pkgit well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pkgit --list
git
pkgit
luajit.git

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pkgit installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 8.0.0.dev0 (unreleased)

  • Add pkgit package manager, with inventory, search, install and full upgrade of the packages it compiles from git repositories.