pkgm¶

ID: pkgm
Home page: https://github.com/pkgxdev/pkgm
Platforms: 🐧 Linux · 🍎 macOS
Operations: installed · outdated · install · upgrade_all · remove
purl types: pkg:pkgm
CLI name: pkgm
Issues and PRs: 📦 manager: pkgm
Source: meta_package_manager/managers/pkgm.toml

pkgm installs pkgx packages to the machine (https://github.com/pkgxdev/pkgm), where pkgx itself only runs them from a cache.

A package is a pantry path such as stedolan.github.io/jq, and every verb agrees on it: the listing prints one per row, and install and uninstall both accept it. An executable name works too, jq reaching the same package, but only the pantry path is what the inventory yields, so it is the identity mpm keys on and the one that round-trips through remove and backup/restore.

Parsing notes, verified against pkgm 0.12.2 on macOS:

The listing prints installation paths, one per line, so the id and the version are read out of a path rather than out of columns. A pantry path carries slashes of its own, and the version always follows the last /v, which is what the greedy id group resolves against.
Colors are unconditional on outdated: pkgm wraps the trailing path in SGR escapes whether or not it writes to a terminal, and honors neither NO_COLOR nor a pipe, both verified. Nothing is forced to suppress them, mpm running every capture through strip_ansi before parsing.
No upgrade_one. pkgm update ignores a package argument outright and upgrades the whole machine regardless: pkgm update <unknown-name> was observed upgrading an unrelated package rather than reporting the name it was given. Declaring it would silently turn a single-package upgrade into a whole-machine one, which is the pamac reading.
No search. pkgm has no search verb at all, upstream’s own framing being that you install by executable name and so never search first.
No sync and no cleanup: nothing refreshes the pantry without also acting on it, and nothing reclaims space.

Caution

pkgm exits 0 on every failure observed, including no such pkg for a name it does not carry and an uncaught exception from its own runtime. An exit code therefore proves nothing about whether an operation did anything, and a failed removal is reported to mpm as a success.

Note

Dependencies are installed as packages in their own right and listed as such: installing jq also lists github.com/kkos/oniguruma. Removal is not transitive, so a dependency outlives the package that brought it in.

Note

Every message names a /usr/local/pkgs/... destination even when the write goes to ~/.local/pkgs, which is where an unprivileged run puts it. The path in the output is cosmetic; the one in the listing is real.

What `mpm` adds to `pkgm`¶

mpm reaches across every manager at once, not pkgm alone: mpm installed and mpm outdated cover pkgm alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pkgm` commands, in `mpm`¶

You already know pkgm: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pkgm`	With `mpm`
List what’s installed	`pkgm list`	`mpm --pkgm installed`
List outdated packages	`pkgm outdated`	`mpm --pkgm outdated`
Install a package	`pkgm install <package_id>`	`mpm install pkg:pkgm/<package_id>`
Upgrade everything	`pkgm update`	`mpm --pkgm upgrade --all`
Remove a package	`pkgm uninstall <package_id>`	`mpm remove pkg:pkgm/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`
`install`	✓
`upgrade`
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `pkgm`¶

Deselect pkgm for a single run with --no-pkgm, or persist the choice in your configuration:

[mpm]
pkgm = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pkgm]
timeout = 900

mpm config-template pkgm prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around pkgm, one mpm command each:

Snapshot and clone a machine: mpm --pkgm dump pkgm.toml, then mpm restore pkgm.toml on the next one.
Export a compliance SBOM: mpm --pkgm sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of pkgm’s release-age gating, from the cooldown support table:

Status: ❌ None (pkgx pantry, no publication date on any surface)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: pkgx pantry (dist.pkgx.dev)
Retraction: Pantry edit: a package is a per-platform versions.txt served from the distribution host, so a version is withdrawn by dropping its line and ceasing to serve the tarball behind it
Publish date: ❌ no surface prints a publication date, the distribution index listing versions alone

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ pkgm --version
pkgm 0.12.2

and extracted with:

r"pkgm[ \t]+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know pkgm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pkgm list
~/.local/pkgs/stedolan.github.io/jq/v1.8.2
~/.local/pkgs/github.com/kkos/oniguruma/v6.9.10

$ pkgm outdated
stedolan.github.io/jq is outdated 1.7.1 < 1.8.2 [2m/root/.local/pkgs/stedolan.github.io/jq/v1.7.1[22m

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pkgm installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add pkgm package manager, with inventory, outdated, install, remove and full upgrade support.