gup¶

ID: gup
Links: Documentation · Repository
Upstream stars: ⭐ 609
Last commit: 2026-09-28
Version requirement: >= 1.3.1
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · upgrade · upgrade_all · remove
purl types: pkg:gup/
CLI name: gup
Issues and PRs: 📦 manager: go-based
Source: gup.toml

gup updates and removes the binaries go install leaves under $GOBIN (https://github.com/nao1215/gup).

A package is the binary name. It is what the listing reports first, what remove and update accept, and what gup itself prints when it tells the user how to update one. The module path sits beside it in every record, and no verb takes it.

Note

gup covers the same binaries go lists, and both are wrapped on purpose: the Go toolchain has no removal verb in any scope and reports no staleness, so remove, outdated and upgrade are reachable through gup alone. A host carrying both therefore reports every Go command twice, under two ids, go keying on the import path and gup on the binary name.

Parsing notes, verified against gup 1.8.1 on macOS:

Both queries read --json, a flat top-level array whose field names upstream commits to in cmd/jsonout.go: “The field names are part of the public contract documented in the README.”
check reports every binary, with a status of up-to-date or update-available, and --quiet trims the text output alone rather than the JSON. Nothing filters it here: mpm’s own refiltered_outdated drops the entries whose two versions match, which is what that filter is for.
remove refuses wherever stdin is not a terminal, answering gup remove requires confirmation, but stdin is not a TTY, so --force is passed.
update takes binary names as positionals, which its own usage line omits: gup update [flags] is what the help documents, and gup update zvm runs.
Versions carry the v the Go module proxy reports, v1.8.1 rather than 1.8.1.
No install, gup installing nothing it was not already given: go install is what creates a binary, and import only replays a manifest. No search either, gup owning no catalog of its own.

Caution

check and update shell out to the Go toolchain and fail loudly without it, answering you didn't install golang. The listing reads the binaries themselves and needs nothing, which upstream settled in 1.7.1: “don’t require the go command for local-only work”.

What `mpm` adds to `gup`¶

mpm reaches across every manager at once, not gup alone: mpm installed and mpm outdated cover gup alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `gup` commands, in `mpm`¶

You already know gup: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `gup`	With `mpm`
List what’s installed	`gup list --json`	`mpm --gup installed`
List outdated packages	`gup check --json`	`mpm --gup outdated`
Upgrade one package	`gup update <package_id>`	`mpm --gup upgrade <package_id>`
Upgrade everything	`gup update`	`mpm --gup upgrade --all`
Remove a package	`gup remove --force <package_id>`	`mpm remove pkg:gup/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✅
`outdated`	✅
`orphans`
`search`
`install`
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore gup on the mpm CLI by passing the --no-gup option.
Ignore it for every run in your configuration:
```
[mpm]
gup = false
```
Raise the timeout of all gup calls:
```
[mpm.overrides.gup]
timeout = 900
```

Run mpm config-template gup to print all overridable settings for your configuration file:

[mpm.overrides.gup]
cli_names = [
    "gup",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=1.3.1"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "version",
]
version_regexes = [
    "gup\\s+version\\s+v?(?P<version>\\S+)",
]

Recipes¶

A few jobs you would otherwise script around gup, one mpm command each:

Snapshot and clone a machine: mpm --gup dump gup.toml, then mpm restore gup.toml on the next one.
Export a compliance SBOM: mpm --gup sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of gup’s release-age gating, from the cooldown support table:

Status: ❌ None (Go module proxy, no publication-date filter)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Go module proxy (pkg:golang)
Retraction: Retraction marker: a version stays served forever, the proxy being an immutable cache, so it is withdrawn by the author adding a retract directive to a newer go.mod that clients then skip
Publish date: ❌ no CLI surface prints one, though the proxy does serve a per-version .info timestamp

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the bundled definition. If you know gup well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ gup list --json
[
  {
    "name": "gup",
    "import_path": "github.com/nao1215/gup",
    "module_path": "github.com/nao1215/gup",
    "channel": "latest",
    "current_version": "v1.8.1",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  },
  {
    "name": "hello",
    "import_path": "golang.org/x/example/hello",
    "module_path": "golang.org/x/example/hello",
    "channel": "latest",
    "current_version": "v0.0.0-20250915201037-7f05d217867b",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  },
  {
    "name": "zvm",
    "import_path": "github.com/tristanisham/zvm",
    "module_path": "github.com/tristanisham/zvm",
    "channel": "latest",
    "current_version": "v0.8.29",
    "latest_version": "",
    "current_go_version": "go1.27.0",
    "installed_go_version": "unknown",
    "status": "installed"
  }
]

$ gup check --json
[
  {
    "name": "gup",
    "import_path": "github.com/nao1215/gup",
    "module_path": "github.com/nao1215/gup",
    "channel": "latest",
    "current_version": "v1.8.1",
    "latest_version": "v1.8.1",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "up-to-date"
  },
  {
    "name": "hello",
    "import_path": "golang.org/x/example/hello",
    "module_path": "golang.org/x/example/hello",
    "channel": "latest",
    "current_version": "v0.0.0-20250915201037-7f05d217867b",
    "latest_version": "v0.0.0-20250915201037-7f05d217867b",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "up-to-date"
  },
  {
    "name": "zvm",
    "import_path": "github.com/tristanisham/zvm",
    "module_path": "github.com/tristanisham/zvm",
    "channel": "latest",
    "current_version": "v0.8.29",
    "latest_version": "v0.9.1",
    "current_go_version": "go1.27.0",
    "installed_go_version": "go1.27.0",
    "status": "update-available"
  }
]

Version check¶

The version is probed by running:

$ gup version
gup version v1.8.1 (under Apache License version 2.0)

and extracted with:

r"gup\s+version\s+v?(?P<version>\S+)"

Upstream project¶

Metrics	`nao1215/gup`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Add the gup package manager, reporting, removing and upgrading the binaries go install leaves under $GOBIN.