pkgcore pmerge

ID

pmerge

Links

Documentation · Repository

Version requirement

>= 0.12.29

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup

purl types

pkg:ebuild/ · pkg:pmerge/

CLI name

pmerge

Every call

pmerge --color no <command>

Issues and PRs

📦 manager: ebuild-based

Source

pmerge.py

pkgcore’s pmerge, an alternative package manager for Gentoo.

pkgcore reads the same ebuild repositories as Portage and records into the same database of installed packages. On a host that carries both, this manager and emerge list the same packages, and each one sees what the other installed.

The queries run through pquery, the inventory and search tool of pkgcore, and the maintenance through pmaint and pclean. All four ship together.

A fresh stage3 ships /var/cache/distfiles owned by root with mode 0755, and every pmerge fetch then fails with Permission denied. Give the directory to the portage user first: chown portage:portage /var/cache/distfiles.

Caution

Installs and upgrades compile from source, so their duration comes from the package rather than from the network. A small program finishes well inside the 500 second ceiling mpm puts on a state-changing command, where a compiler or a browser does not. Raise the ceiling for this manager alone, in the configuration file:

[mpm.overrides.pmerge]
timeout = 14400

What mpm adds to pmerge

mpm reaches across every manager at once, not pmerge alone: mpm installed and mpm outdated cover pmerge alongside emerge and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pmerge commands, in mpm

You already know pmerge: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pmerge	With mpm
List what’s installed	pquery --installed --format <category>/<package>=<fullver>	mpm --pmerge installed
List outdated packages	pquery --installed --format <category>/<package>:<slot>=<fullver>	mpm --pmerge outdated
Search for a package	pquery --max --format <category>/<package>=<fullver>=<description> nyancat	mpm --pmerge search nyancat
Install a package	sudo pmerge games-misc/nyancat	mpm install pkg:pmerge/games-misc/nyancat
Upgrade one package	sudo pmerge --upgrade app-crypt/libmd	mpm --pmerge upgrade app-crypt/libmd
Upgrade everything	sudo pmerge --upgrade --deep --newuse @world @system	mpm --pmerge upgrade --all
Remove a package	sudo pmerge --unmerge games-misc/nyancat	mpm remove pkg:pmerge/games-misc/nyancat
List orphaned dependencies	pmerge --pretend --clean	mpm --pmerge orphans
Clear caches	sudo pclean dist --installed	mpm --pmerge cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✅
outdated	✅
orphans	✅
search	✅
install	✅
upgrade	✅
upgrade_all	✅
remove	✅
sync	✅
cleanup	✅	The --orphans flag runs the system-wide orphan sweep.
doctor

Configuration

• Ignore pmerge on the mpm CLI by passing the --no-pmerge option.

• Ignore it for every run in your configuration:

  [mpm]
  pmerge = false
  

• Raise the timeout of all pmerge calls:

  [mpm.overrides.pmerge]
  timeout = 900
  

• Run mpm config-template pmerge to print all overridable settings for your configuration file:

  [mpm.overrides.pmerge]
  cli_names = [
      "pmerge",
  ]
  cli_search_path = []
  dry_run = false
  plan = false
  post_args = []
  pre_args = [
      "--color",
      "no",
  ]
  pre_cmds = []
  requirement = ">=0.12.29"
  stop_on_error = false
  unmaintained = false
  version_cli_options = [
      "--version",
  ]
  version_regexes = [
      "pkgcore\\s+(?P<version>\\S+)",
  ]
  
  [mpm.overrides.pmerge.operations.cleanup_cache]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.cleanup_orphan]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.install]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.installed]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.orphans]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.outdated]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.remove]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.search]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.sync]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.upgrade_all]
  extra_args = []
  
  [mpm.overrides.pmerge.operations.upgrade_one]
  extra_args = []
  

The arguments and environment variables listed in the box atop this page are forced on every pmerge call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes

A few jobs you would otherwise script around pmerge, one mpm command each:

• Snapshot and clone a machine: mpm --pmerge dump pmerge.toml, then mpm restore pmerge.toml on the next one.

• Export a compliance SBOM: mpm --pmerge sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

Its privileged operations are cleanup, install, remove, sync, upgrade, upgrade_all.

See privilege escalation for the full policy.

Cooldown

State of pkgcore pmerge’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Source-based recipe trees

• Retraction: Index revert of the recipe tree

• Publish date: ❌ a recipe carries no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know pkgcore pmerge well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pquery --color no --installed --format {category}/{package}={fullver}
app-text/build-docbook-catalog=2.4
app-text/docbook-xml-dtd=4.1.2-r7
app-text/docbook-xml-dtd=4.2-r3
app-text/docbook-xml-dtd=4.5-r2
app-text/docbook-xsl-ns-stylesheets=1.79.1
app-text/docbook-xsl-stylesheets=1.79.1-r4
app-text/manpager=1

$ pquery --color no --installed --format {category}/{package}:{slot}={fullver}
app-arch/libarchive:0=3.8.10
app-arch/tar:0=1.35-r1
app-arch/unzip:0=6.0_p31
app-arch/xz-utils:0=5.8.3
app-arch/zstd:0=1.5.7-r1
app-crypt/gnupg:0=2.5.24-r2
app-crypt/gpgme:1=2.2.0
app-crypt/libb2:0=0.98.1-r3
app-crypt/libmd:0=1.2.0

$ pquery --color no --upgrade --format {category}/{package}:{slot}={fullver}
app-arch/libarchive:0=3.8.11
app-arch/xz-utils:0=5.8.4
app-crypt/libmd:0=1.3.0

$ pmerge --color no --pretend --clean
 * Packages to be removed:
Remove installed pkg: app-alternatives/lex-0-r1::vdb, source repo 'gentoo'
Remove installed pkg: app-alternatives/ninja-1::vdb, source repo 'gentoo'
Remove installed pkg: app-alternatives/yacc-1-r2::vdb, source repo 'gentoo'
Remove installed pkg: app-arch/unzip-6.0_p31::vdb, source repo 'gentoo'

Version check

The version is probed by running:

$ pmerge --version
pkgcore 0.12.48

and extracted with:

r"pkgcore\s+(?P<version>\S+)"

Changelog

• 8.3.0.dev0 (unreleased)

  • Add pkgcore’s pmerge package manager for Gentoo, with installed, outdated, orphans, search, install, upgrade, remove, sync and cleanup support.