Image Packaging System

ID

ips

Links

Documentation · Repository · Wikipedia

Upstream stars

⭐ 34

Last commit

2026-08-24

Platforms

⨂ Unix (illumos, Solaris only)

Operations

installed · search · install · upgrade · upgrade_all · remove · sync · cleanup

purl types

pkg:ips/

CLI name

pkg

Issues and PRs

📦 manager: ips

Source

ips.py

The Image Packaging System, the native pkg of Solaris and illumos.

The CLI is named pkg, which the FreeBSD PKG manager also claims. The two never coexist, their platforms being disjoint, but the manager ID here is ips so the two stay addressable apart.

Note

Only root may modify the image, so mutating operations escalate through sudo. sync escalates too: refreshing the catalog writes into the image’s own metadata rather than a user cache.

Caution

The inventory is a local read: the catalog is not refreshed, so the listing works offline.

Todo

Implement outdated, on a host whose image has fallen behind its publisher: that is the only state emitting output that names both the installed and the available version, and the one illumos host available reported no packages have newer versions available.

The state cannot be manufactured on a consistent image, so do not spend time trying: installing a superseded build to force one is refused with did not match any allowable packages, the release incorporations constraining an image to one allowable version per package. Inventing a fixture is not an option either, a sample having to parse through this manager’s own parser and having to be real.

What mpm adds to ips

Through mpm, ips gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover ips alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your ips commands, in mpm

You already know ips: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With ips	With mpm
List what’s installed	pkg list -H --no-refresh	mpm --ips installed
Search for a package	pkg search -H -p tar	mpm --ips search tar
Install a package	sudo pkg install --accept archiver/gnu-tar	mpm install pkg:ips/archiver/gnu-tar
Upgrade one package	sudo pkg update --accept archiver/gnu-tar	mpm --ips upgrade archiver/gnu-tar
Upgrade everything	sudo pkg update --accept	mpm --ips upgrade --all
Remove a package	sudo pkg uninstall archiver/gnu-tar	mpm remove pkg:ips/archiver/gnu-tar
Clear caches	sudo pkg purge-history	mpm --ips cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✅
outdated	❌	Awaiting a real sample naming both the installed and the available version, which only a host whose image has fallen behind its publisher emits.
orphans
search	✅	Exact and extended search backfilled by mpm.
install	✅
upgrade	✅
upgrade_all	✅
remove	✅
sync	✅
cleanup	✅
doctor

Configuration

• Ignore ips on the mpm CLI by passing the --no-ips option.

• Ignore it for every run in your configuration:

  [mpm]
  ips = false
  

• Raise the timeout of all ips calls:

  [mpm.overrides.ips]
  timeout = 900
  

• Run mpm config-template ips to print all overridable settings for your configuration file:

  [mpm.overrides.ips]
  cli_names = [
      "pkg",
  ]
  cli_search_path = []
  dry_run = false
  ignore_auto_updates = true
  plan = false
  post_args = []
  pre_args = []
  pre_cmds = []
  stop_on_error = false
  unmaintained = false
  version_cli_options = [
      "list",
      "-H",
      "--no-refresh",
      "package/pkg",
  ]
  version_regexes = [
      "package/pkg\\s+(?P<version>\\S+)",
  ]
  

Recipes

A few jobs you would otherwise script around ips, one mpm command each:

• Snapshot and clone a machine: mpm --ips dump ips.toml, then mpm restore ips.toml on the next one.

• Export a compliance SBOM: mpm --ips sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

Its privileged operations are cleanup, install, remove, sync, upgrade, upgrade_all.

See privilege escalation for the full policy.

Cooldown

State of Image Packaging System’s release-age gating, from the cooldown support table:

Status: ❌ None (packaging dates are publisher-set manifest metadata)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)

• Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)

• Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Image Packaging System well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pkg list -H --no-refresh
SUNWcs                                            0.5.11-2026.0.0.23029      i--
SUNWcsd                                           0.5.11-2026.0.0.23029      i--
archiver/gnu-tar                                  1.35-2023.0.0.0            i--
audio/audio-utilities                             0.5.11-2026.0.0.23029      i--
audio/lame                                        3.100-2025.0.0.3           i--

Version check

The version is probed by running:

$ pkg list -H --no-refresh package/pkg
package/pkg                                       0.5.11-2025.0.0.5626       i--

and extracted with:

r"package/pkg\s+(?P<version>\S+)"

Upstream project

Metrics	OpenIndiana/pkg5
Activity
Popularity
Metadata

Changelog

• 8.0.0 (2026-09-20)

  • Add the Image Packaging System of Solaris and illumos, with inventory, search, install, remove, upgrade, catalog sync and history purge.

  • Fix mpm crashing on every illumos host, where the platform probe matched Solaris too and the i86pc machine string went unrecognized.