Arch Linux trizen

ID

trizen

Home page

https://github.com/trizen/trizen

Version requirement

>= 1

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor

purl types

pkg:trizen

CLI name

trizen

Every call

trizen --noconfirm --color never <command>

Issues and PRs

📦 manager: pacman-based

Source

meta_package_manager/managers/pacman.py

AUR helper wrapping pacman, driven through the trizen binary.

Inherits every operation, parser and forced argument from Pacman; the binary, the version probe and the release floor are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories.

Like the other helpers, trizen must run as the regular user: makepkg refuses to build as root, and trizen calls sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

Note

Upstream is slow rather than stopped: commits continue, but 1.68 of December 2022 is still the newest release. It stays unflagged here because the stability policy keys unmaintained on an abandoned upstream, not on a quiet release cadence.

Documentation: trizen.

What mpm adds to trizen

Through mpm, trizen gains:

  • a one-command cleanup --orphans that removes every orphaned dependency at once

  • --extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover trizen alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your trizen commands, in mpm

You already know trizen: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With trizen

With mpm

List what’s installed

pacman --query

mpm --trizen installed

List outdated packages

pacman --query --upgrades

mpm --trizen outdated

Search for a package

pacman --sync --search fire

mpm --trizen search fire

Install a package

sudo pacman --sync firefox

mpm install pkg:trizen/firefox

Upgrade one package

sudo pacman --sync firefox

mpm --trizen upgrade firefox

Upgrade everything

sudo pacman --sync --refresh --sysupgrade

mpm --trizen upgrade --all

Remove a package

sudo pacman --remove firefox

mpm remove pkg:trizen/firefox

List orphaned dependencies

pacman --query --deps --unrequired

mpm --trizen orphans

Clear caches

sudo pacman --sync --clean --clean

mpm --trizen cleanup --cache

Run health checks

pacman --database --check

mpm --trizen doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

orphans

✓

search

✓

extended search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

--orphans also drops the package’s orphaned dependencies

sync

✓

cleanup

✓

--orphans sweep backfilled by mpm

doctor

✓

Selecting and configuring trizen

Deselect trizen for a single run with --no-trizen, or persist the choice in your configuration:

[mpm]
trizen = false

The arguments and environment variables listed in the box atop this page are forced on every trizen call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.trizen]
timeout = 900

mpm config-template trizen prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around trizen, one mpm command each:

  • Snapshot and clone a machine: mpm --trizen dump trizen.toml, then mpm restore trizen.toml on the next one.

  • Export a compliance SBOM: mpm --trizen sbom (CycloneDX by default, --spdx for SPDX).

  • Gate CI on health: mpm --trizen doctor relays Arch Linux trizen’s own diagnosis and exits non-zero on trouble.

Privilege escalation

Arch Linux trizen runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Cooldown

Not yet assessed in the cooldown support table.

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: AUR

  • Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package

  • Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay gates on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ trizen --version
trizen 1.68

and extracted with:

r"trizen\s+(?P<version>\S+)"

Changelog

  • 7.7.0.dev0 (unreleased)

    • Add the trizen AUR helper with the full operation set inherited from pacman.