Scoop sfsu¶

ID: sfsu
Home page: https://github.com/winpax/sfsu
Version requirement: >= 1.16
Platforms: 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · sync · cleanup
purl types: pkg:sfsu
CLI name: sfsu
Every call: sfsu <command> --no-color
Issues and PRs: 📦 manager: scoop-based
Source: meta_package_manager/managers/sfsu.py

sfsu (Scoop For Speed and Usability) is a Rust reimplementation of Scoop’s slower read paths, working against the same buckets and ~/scoop install tree.

mpm reaches for sfsu only where it is both faster than Scoop and speaks JSON: installed, outdated and search all pass --json and are parsed as structured objects instead of the whitespace tables Scoop prints.

Note

sfsu implements no mutating verbs, so install, remove and both upgrade commands are bound straight to Scoop through the Delegate descriptor: those operations run the scoop binary, and a host with sfsu but no Scoop cannot mutate anything.

What `mpm` adds to `sfsu`¶

Through mpm, sfsu gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover sfsu alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `sfsu` commands, in `mpm`¶

You already know sfsu: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `sfsu`	With `mpm`
List what’s installed	`sfsu list --json`	`mpm --sfsu installed`
List outdated packages	`sfsu status --only apps --json`	`mpm --sfsu outdated`
Search for a package	`sfsu search --json git`	`mpm --sfsu search git`
Clear caches	`sfsu cleanup --all --cache`	`mpm --sfsu cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact and extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`	✓
`doctor`

Selecting and configuring `sfsu`¶

Deselect sfsu for a single run with --no-sfsu, or persist the choice in your configuration:

[mpm]
sfsu = false

The arguments and environment variables listed in the box atop this page are forced on every sfsu call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.sfsu]
timeout = 900

mpm config-template sfsu prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around sfsu, one mpm command each:

Snapshot and clone a machine: mpm --sfsu dump sfsu.toml, then mpm restore sfsu.toml on the next one.
Export a compliance SBOM: mpm --sfsu sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of Scoop sfsu’s release-age gating, from the cooldown support table:

Status: 🚧 Inherits from scoop

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Git-manifest indexes
Retraction: Index revert: reverting the manifest, Portfile or derivation commit withdraws the version
Publish date: ❌ only the commit date, which is client-set and trivially backdated

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ sfsu --version
sfsu 1.17.2
sprinkles 0.22.0 (crates.io published version)

and extracted with:

r"sfsu\s+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Scoop sfsu well and a transcript below looks wrong, or a newer release changed its output format, report it.

> sfsu list --json
[
  {
    "name": "7zip",
    "version": "26.00",
    "source": "main",
    "updated": "2026-03-18 17:54:32",
    "notes": ""
  },
  {
    "name": "git",
    "version": "2.53.0.3",
    "source": "main",
    "updated": "2026-03-15 09:12:04",
    "notes": ""
  }
]

> sfsu status --only apps --json
{
  "packages": [
    {
      "name": "git",
      "current": "2.53.0.2",
      "available": "2.53.0.3",
      "missing_dependencies": [],
      "info": null
    }
  ]
}

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --sfsu installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

6.4.0 (2026-04-27)
- Add sfsu (Scoop alternative) package manager with installed, outdated, search, install, upgrade, remove, sync, and cleanup support. Mutating operations delegate to Scoop.