Zero Install

ID

zeroinstall

Home page

https://0install.net

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

search · remove · cleanup

purl types

pkg:zeroinstall

CLI name

0install

Every call

0install --console <command>

Issues and PRs

📦 manager: zeroinstall

Source

meta_package_manager/managers/zero_install.py

Zero Install is a decentralised, cross-platform installation system.

There is no central registry. A program is identified by the URL of its feed, an XML document its own publisher hosts and signs with their own GPG key, so a package id here is a feed URI rather than a short name. Short names collide freely across publishers: one search for python returns a Python feed from apps.0install.net, another from 0install.de and a third from dispcalgui.hoech.net.

A second identifier sits beside the URI. An application is a pet name the user invents and binds to a feed, which is what destroy and update address. The two identifier spaces are what shape the operation set below.

Caution

No installed: 0install list looks like an inventory and is not. It prints the URI of every feed in the local cache, which is the set of feeds ever fetched rather than the set of programs installed. Upstream says so in the command’s own source, src/cli/list_ifaces.ml, which calls Feed_cache.list_all_feeds under the comment “Actually, we list all the cached feeds. Close enough.”

Driving it proves how wide the gap is. On a host where exactly one application was added, 0install list returned thirteen URIs: the feeds the solver merely consulted to resolve dependencies, and xz, whose selection had failed outright with “No usable implementations” and which downloaded not one byte. Reporting those as installed would be false. The listing also never prints a pet name, so nothing it emits can be handed back to destroy.

Caution

No install: 0install add takes two mandatory arguments, the pet name to create and the feed URI to bind it to, and refuses a lone URI. mpm’s install carries a single package id, which cannot supply both, and inventing a pet name for the user would name their application for them. sheldon declines the operation for the same reason.

Note

No outdated: nothing reports staleness without acting on it. update does print when a newer version exists, but it is the upgrade itself and needs an application named on the command line.

Note

No upgrade of either shape. 0install update requires an application or a URI and the tool ships no bulk form, so there is no upgrade --all to build. The single-package form is out for a second reason: mpm resolves which manager sources a package by querying its inventory, and this manager has none to query, so the operation could never be dispatched here.

Note

No sync: refreshing is the --refresh flag of the commands that already resolve a feed, never a command of its own.

Note

No version floor is declared. Every subcommand this class drives predates the oldest release upstream’s CHANGES.md documents, so no floor could be verified rather than guessed. The class was driven against 2.18.

Documentation: 0install.

What mpm adds to zeroinstall

Through mpm, zeroinstall gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover zeroinstall alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your zeroinstall commands, in mpm

You already know zeroinstall: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With zeroinstall	With mpm
Search for a package	0install search hello	mpm --zeroinstall search hello
Remove a package	0install destroy zeroinstall	mpm remove pkg:zeroinstall/destroy
Clear caches	0install store optimise	mpm --zeroinstall cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed
outdated
orphans
search	✓	exact and extended search backfilled by mpm
install
upgrade
upgrade_all
remove	✓
sync
cleanup	✓
doctor

Selecting and configuring zeroinstall

Deselect zeroinstall for a single run with --no-zeroinstall, or persist the choice in your configuration:

[mpm]
zeroinstall = false

The arguments and environment variables listed in the box atop this page are forced on every zeroinstall call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.zeroinstall]
timeout = 900

mpm config-template zeroinstall prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around zeroinstall, one mpm command each:

• Snapshot and clone a machine: mpm --zeroinstall dump zeroinstall.toml, then mpm restore zeroinstall.toml on the next one.

• Export a compliance SBOM: mpm --zeroinstall sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Zero Install’s release-age gating, from the cooldown support table:

Status: ❌ None (dates are author-written in a publisher-hosted feed)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Publisher-hosted signed feeds

• Retraction: Feed edit: no index stands between a name and the code, a program being an XML feed its own publisher hosts and signs, so a version is withdrawn by that publisher dropping its implementation element and re-signing the document

• Publish date: ❌ a feed’s released attribute is written by the publisher into the document they sign, so it is author-set

Version probe

The version is probed by running:

$ 0install --version
0install (zero-install) 2.18
Copyright (C) 2019 Thomas Leonard
This program comes with ABSOLUTELY NO WARRANTY,
to the extent permitted by law. You may redistribute copies of this program
under the terms of the GNU Lesser General Public License.
For more information about these matters, see the file named COPYING.
Compiled with D-Bus support: false
HTTP client library: libcurl (C)

and extracted with:

r"0install\s+\(zero-install\)\s+(?P<version>\S+)"

Changelog

• 8.0.0.dev0 (unreleased)

  • Add Zero Install package manager, with search, remove and cache cleanup support.