LURE¶

Note

LURE’s own forge at git.elara.ws answers 502 and lure.sh answers 404 behind a placeholder certificate, so its installer and release binaries are both unreachable and the tool has to be built from source. Its author announced a pause rather than an end in lure-sh/lure#89 on 2025-05-04, “I intend to start working on it again as soon as I’m in a stable position again”, and the recipe repository this manager reads is on GitHub and still moving.

ID: lure
Link: Repository
Upstream stars: ⭐ 431
Last commit: 2023-12-25
Version requirement: >= 0.1.3
Platforms: 🐧 Linux
Operations: installed · search · install · sync
purl types: pkg:lure/
CLI name: lure
Issues and PRs: 📦 manager: lure
Source: lure.py

LURE, the Linux User REpository: an AUR-shaped build system for any distro.

A package is a build recipe in a git repository LURE clones, and the resulting artifact is handed to the host’s own package manager, so LURE reaches packages no distro archive carries while leaving the installed state with apt, dnf, pacman or whichever backend the host runs.

Important

LURE escalates itself and refuses to be escalated. It aborts as root with “Running LURE as root is forbidden as it may cause catastrophic damage to your system”, and calls its own configured RootCmd (sudo by default) for the privileged half. mpm therefore marks nothing here privileged, the same treatment chromebrew gets.

Note

Every subcommand pulls its repositories before doing anything else, so even a listing costs a network round-trip and prints the git progress on <stderr>. Only the packages themselves reach <stdout>.

What `mpm` adds to `lure`¶

Through mpm, lure gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover lure alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `lure` commands, in `mpm`¶

You already know lure: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `lure`	With `mpm`
List what’s installed	`lure list --installed`	`mpm --lure installed`
Search for a package	`lure list`	`mpm --lure search list`
Install a package	`lure install neofetch`	`mpm install pkg:lure/neofetch`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`
`orphans`
`search`	✅	Exact and extended search backfilled by `mpm`.
`install`	✅
`upgrade`	❌	An upgrade reaches the backend without `-y`, so it blocks on a confirmation prompt `mpm` cannot answer.
`upgrade_all`
`remove`	❌	A removal reaches the backend without `-y`, so it blocks on a confirmation prompt `mpm` cannot answer.
`sync`	✅
`cleanup`
`doctor`

Configuration¶

Ignore lure on the mpm CLI by passing the --no-lure option.
Ignore it for every run in your configuration:
```
[mpm]
lure = false
```
Raise the timeout of all lure calls:
```
[mpm.overrides.lure]
timeout = 900
```

Run mpm config-template lure to print all overridable settings for your configuration file:

[mpm.overrides.lure]
cli_names = [
    "lure",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=0.1.3"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "version",
]
version_regexes = [
    "v?(?P<version>\\d+\\.\\d+\\.\\d+)",
]

Recipes¶

A few jobs you would otherwise script around lure, one mpm command each:

Snapshot and clone a machine: mpm --lure dump lure.toml, then mpm restore lure.toml on the next one.
Export a compliance SBOM: mpm --lure sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of LURE’s release-age gating, from the cooldown support table:

Status: ❌ None (a package is a build recipe in a git repository, carrying no publication date)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: LURE recipe repositories
Retraction: Repository edit: a package is a recipe in a git repository LURE tracks, so it is withdrawn by that repository dropping the recipe
Publish date: ❌ a recipe records a version but no date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know LURE well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ lure list --installed
default/neofetch 7.1.0-1

Version check¶

The version is probed by running:

$ lure version
v0.1.3

and extracted with:

r"v?(?P<version>\d+\.\d+\.\d+)"

Upstream project¶

Metrics	`lure-sh/lure`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Add the LURE package manager with inventory, catalog search, install and repository refresh.