Zef

ID

zef

Home page

https://github.com/ugexe/zef

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · search · install · upgrade · upgrade_all · remove · sync

purl types

pkg:perl6 · pkg:zef

CLI name

zef

Issues and PRs

📦 manager: zef

Source

meta_package_manager/managers/zef.py

Zef, the module manager of the Raku language.

A package is a Raku distribution, identified by the bare name its identity string opens with. Raku names are colon-separated (JSON::Fast) and the identity appends its own colon-prefixed fields to them (JSON::Fast:ver<0.20>:auth<zef:timo>), so every pattern here matches the name lazily up to the literal :ver< rather than splitting on colons.

Note

Two distributions may share a name and differ only by the auth field, and several versions of one may be installed side by side. mpm keys a package on its id alone, so both listings are reduced here to one entry per name, keeping the highest version. That reduction is what makes this a class rather than a bundled definition.

Note

Search compounds the same problem rather than avoiding it: it answers with a pipe-delimited table carrying one row per (distribution, version) pair, so a single module comes back once per release it has ever published.

Note

No outdated: zef reports no staleness of its own. upgrade covers both the bulk and the single-package cases natively, so neither is synthesized.

Documentation: zef README.

What mpm adds to zef

Through mpm, zef gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover zef alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your zef commands, in mpm

You already know zef: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With zef	With mpm
List what’s installed	zef list --installed	mpm --zef installed
Search for a package	zef search JSON::Fast	mpm --zef search JSON::Fast
Install a package	zef install JSON::Fast::Hyper	mpm install pkg:zef/JSON::Fast::Hyper
Upgrade one package	zef upgrade JSON::Fast	mpm --zef upgrade JSON::Fast
Upgrade everything	zef upgrade	mpm --zef upgrade --all
Remove a package	zef uninstall JSON::Fast::Hyper	mpm remove pkg:zef/JSON::Fast::Hyper

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync	✓
cleanup
doctor

Selecting and configuring zef

Deselect zef for a single run with --no-zef, or persist the choice in your configuration:

[mpm]
zef = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.zef]
timeout = 900

mpm config-template zef prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around zef, one mpm command each:

• Snapshot and clone a machine: mpm --zef dump zef.toml, then mpm restore zef.toml on the next one.

• Export a compliance SBOM: mpm --zef sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Zef’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Raku ecosystem (pkg:perl6)

• Retraction: Immutable once published: fez, the ecosystem zef resolves against, accepts an upload per version and offers its authors no delete or yank verb, so a withdrawal is an administrative request rather than a client-visible operation

• Publish date: ❌ the identity a distribution is known by carries a version, an authority and an API level but no date, and neither the listing nor the search reports one

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ zef --version
1.1.3

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Zef well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ zef list --installed
===> Found via inst#/opt/homebrew/Cellar/rakudo-star/2026.07/share/perl6/site
App::Prove6:ver<0.0.18>:auth<zef:leont>
Config::TOML:ver<0.1.3>:auth<zef:raku-community-modules>
Config:ver<3.0.4>:auth<cpan:TYIL>:api<3>
Crane:ver<0.1.2>:auth<zef:raku-community-modules>
Digest:ver<1.1.0>:auth<zef:grondilu>

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --zef installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 8.0.0.dev0 (unreleased)

  • Add Zef package manager, with installed, search, install, upgrade, remove and sync support. Raku identity strings are colon-separated, so both listings match the distribution name lazily up to :ver< and reduce the rows to one entry per name.