PackageKit¶

ID: pkcon
Home page: https://www.freedesktop.org/software/PackageKit/
Upstream stars: ⭐ 345
Last commit: 2026-07-28
Version requirement: >= 0.7
Platforms: 🐧 Linux
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · sync
purl types: pkg:pkcon
CLI name: pkcon
Every call: pkcon <command> --plain
Forced environment: LC_ALL=C
Issues and PRs: 📦 manager: pkcon
Source: meta_package_manager/managers/pkcon.py

PackageKit’s console client.

pkcon is an unprivileged client handing transactions to the packagekitd daemon over D-Bus, with the distro’s native backend (apt, dnf, zypp, alpm, …) doing the real work. Escalation is polkit’s job, so no operation is marked sudo: under a strict polkit policy, unattended mutations need a policy permitting them without interactive authentication.

Note

pkcon renders packages as a fused name-version.arch (repo) string and never exposes the raw name;version;arch;repo ID. Names and versions both legitimately contain dashes, so the name/version split below anchors on the first dash followed by a digit: a documented heuristic, not an exact science.

What `mpm` adds to `pkcon`¶

Through mpm, pkcon gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pkcon alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pkcon` commands, in `mpm`¶

You already know pkcon: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pkcon`	With `mpm`
List what’s installed	`pkcon get-packages --filter installed`	`mpm --pkcon installed`
List outdated packages	`pkcon get-updates`	`mpm --pkcon outdated`
Search for a package	`pkcon search name hello`	`mpm --pkcon search hello`
Install a package	`pkcon install --noninteractive hello`	`mpm install pkg:pkcon/hello`
Upgrade one package	`pkcon update --noninteractive hello`	`mpm --pkcon upgrade hello`
Upgrade everything	`pkcon update --noninteractive`	`mpm --pkcon upgrade --all`
Remove a package	`pkcon remove --noninteractive hello`	`mpm remove pkg:pkcon/hello`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact and extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`
`doctor`

Selecting and configuring `pkcon`¶

Deselect pkcon for a single run with --no-pkcon, or persist the choice in your configuration:

[mpm]
pkcon = false

The arguments and environment variables listed in the box atop this page are forced on every pkcon call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pkcon]
timeout = 900

mpm config-template pkcon prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around pkcon, one mpm command each:

Snapshot and clone a machine: mpm --pkcon dump pkcon.toml, then mpm restore pkcon.toml on the next one.
Export a compliance SBOM: mpm --pkcon sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of PackageKit’s release-age gating, from the cooldown support table:

Status: ➖ N/A (delegates to the distro backend)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: No registry of their own
Retraction: ➖ Not applicable: these managers either delegate to whichever manager they front (pkcon, topgrade) or wrap a retired project or a discontinued platform

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ pkcon --version
1.3.6

and extracted with:

r"^(?P<version>[\d.]+)$"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know PackageKit well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pkcon get-packages --filter installed --plain
Installed    gzip-1.12-1.fc38.x86_64 (koji-override-0)
Installed    hello-2.12.1-2.fc38.x86_64 (fedora)

$ pkcon get-updates --plain
Security     curl-8.0.1-2.fc38.x86_64 (updates)
Normal       hello-2.12.2-1.fc38.x86_64 (updates)

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pkcon installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project¶

Metrics	`PackageKit/PackageKit`
Activity
Popularity
Metadata

Changelog¶

8.0.0.dev0 (unreleased)
- Declare support for the Linux compatibility layers, WSL included, in place of the Linux distributions alone. Their platform set matched none of the groups the documentation classifies against, so the readme’s operation matrix reported no platform at all for am, nala, pamac and pkcon, and Windows alone for miktex.
7.2.0 (2026-07-09)
- Add PackageKit’s console client (pkcon) with installed, outdated, search, install, upgrade, remove and sync support on Linux. Requires PackageKit >=0.7.0.