Arch Linux trizen

ID

trizen

Home page

https://github.com/trizen/trizen

Upstream stars

⭐ 824

Last commit

2025-08-11

Version requirement

>= 1

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor

purl types

pkg:trizen

CLI name

trizen

Every call

trizen --noconfirm --color never <command>

Issues and PRs

📦 manager: pacman-based

Source

meta_package_manager/managers/pacman.py

AUR helper wrapping pacman, driven through the trizen binary.

Inherits every operation, parser and forced argument from Pacman; the binary, the version probe and the release floor are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories.

Like the other helpers, trizen must run as the regular user: makepkg refuses to build as root, and trizen calls sudo pacman itself for the privileged steps. mpm therefore never wraps it in sudo.

Note

Upstream is slow rather than stopped: commits continue, but 1.68 of December 2022 is still the newest release. It stays unflagged here because the stability policy keys unmaintained on an abandoned upstream, not on a quiet release cadence.

Documentation: trizen.

What mpm adds to trizen

Through mpm, trizen gains:

• a one-command cleanup --orphans that removes every orphaned dependency at once

• --extended search, to match against package descriptions

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover trizen alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your trizen commands, in mpm

You already know trizen: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With trizen	With mpm
List what’s installed	pacman --query	mpm --trizen installed
List outdated packages	pacman --query --upgrades	mpm --trizen outdated
Search for a package	pacman --sync --search fire	mpm --trizen search fire
Install a package	sudo pacman --sync firefox	mpm install pkg:trizen/firefox
Upgrade one package	sudo pacman --sync firefox	mpm --trizen upgrade firefox
Upgrade everything	sudo pacman --sync --refresh --sysupgrade	mpm --trizen upgrade --all
Remove a package	sudo pacman --remove firefox	mpm remove pkg:trizen/firefox
List orphaned dependencies	pacman --query --deps --unrequired	mpm --trizen orphans
Clear caches	sudo pacman --sync --clean --clean	mpm --trizen cleanup --cache
Run health checks	pacman --database --check	mpm --trizen doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans	✓
search	✓	extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓	--orphans also drops the package’s orphaned dependencies
sync	✓
cleanup	✓	--orphans sweep backfilled by mpm
doctor	✓

Selecting and configuring trizen

Deselect trizen for a single run with --no-trizen, or persist the choice in your configuration:

[mpm]
trizen = false

The arguments and environment variables listed in the box atop this page are forced on every trizen call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.trizen]
timeout = 900

mpm config-template trizen prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around trizen, one mpm command each:

• Snapshot and clone a machine: mpm --trizen dump trizen.toml, then mpm restore trizen.toml on the next one.

• Export a compliance SBOM: mpm --trizen sbom (CycloneDX by default, --spdx for SPDX).

• Gate CI on health: mpm --trizen doctor relays Arch Linux trizen’s own diagnosis and exits non-zero on trouble.

Privilege escalation

Arch Linux trizen runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Concurrency

mpm never runs trizen at the same time as pacaur, pacman, pamac, paru, pikaur or yay: they all reach the pacman database (/var/lib/pacman/db.lck), and two of them mutating at once fail to init their transaction. Each mutating operation waits for the previous one, even with a higher --jobs, while managers outside this group keep running in parallel.

Only mutations are held back. The read-only queries (installed, outdated, search) take no backend lock and stay fully concurrent.

Cooldown

Not yet assessed in the cooldown support table.

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: AUR

• Retraction: None at the version level: an AUR package is a git repository with no per-version artifact to withdraw, so remediation is a maintainer push or deletion of the whole package

• Publish date: ✅ server-set LastModified, the push timestamp mpm’s yay overlay gates on. Git commit dates are client-set (GIT_COMMITTER_DATE), forgeable, and never consulted

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ trizen --version
trizen 1.68

and extracted with:

r"trizen\s+(?P<version>\S+)"

Upstream project

Metrics	trizen/trizen
Activity
Popularity
Metadata

Changelog

• 8.0.0.dev0 (unreleased)

  • Stop running the AUR helpers concurrently with pacman and with each other. All of them drive the same pacman database, either by shelling out to sudo pacman or, for pamac, through Manjaro’s own libalpm binding, so two mutating at once failed to init their transaction.

  • Add the trizen AUR helper with the full operation set inherited from pacman.