pkgm

ID

pkgm

Link

Repository

Upstream stars

⭐ 62

Last commit

2026-05-18

Platforms

🐧 Linux · 🍎 macOS

Operations

installed · outdated · install · upgrade_all · remove

purl types

pkg:pkgm/

CLI name

pkgm

Issues and PRs

📦 manager: pkgm

Source

pkgm.toml

pkgm installs pkgx packages to the machine (https://github.com/pkgxdev/pkgm), where pkgx itself only runs them from a cache.

A package is a pantry path such as stedolan.github.io/jq, and every verb agrees on it: the listing prints one per row, and install and uninstall both accept it. An executable name works too, jq reaching the same package, but only the pantry path is what the inventory yields, so it is the identity mpm keys on and the one that round-trips through remove and backup/restore.

Parsing notes, verified against pkgm 0.12.2 on macOS:

• The listing prints installation paths, one per line, so the id and the version are read out of a path rather than out of columns. A pantry path carries slashes of its own, and the version always follows the last /v, which is what the greedy id group resolves against.

• Colors are unconditional on outdated: pkgm wraps the trailing path in SGR escapes whether or not it writes to a terminal, and honors neither NO_COLOR nor a pipe, both verified. Nothing is forced to suppress them, mpm running every capture through strip_ansi before parsing.

• No upgrade_one. pkgm update ignores a package argument outright and upgrades the whole machine regardless: pkgm update <unknown-name> was observed upgrading an unrelated package rather than reporting the name it was given. Declaring it would silently turn a single-package upgrade into a whole-machine one, which is the pamac reading.

• No search. pkgm has no search verb at all, upstream’s own framing being that you install by executable name and so never search first.

• No sync and no cleanup: nothing refreshes the pantry without also acting on it, and nothing reclaims space.

Caution

pkgm exits 0 on every failure observed, including no such pkg for a name it does not carry and an uncaught exception from its own runtime. An exit code therefore proves nothing about whether an operation did anything, and a failed removal is reported to mpm as a success.

Note

Dependencies are installed as packages in their own right and listed as such: installing jq also lists github.com/kkos/oniguruma. Removal is not transitive, so a dependency outlives the package that brought it in.

Note

Every message names a /usr/local/pkgs/... destination even when the write goes to ~/.local/pkgs, which is where an unprivileged run puts it. The path in the output is cosmetic; the one in the listing is real.

What mpm adds to pkgm

mpm reaches across every manager at once, not pkgm alone: mpm installed and mpm outdated cover pkgm alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pkgm commands, in mpm

You already know pkgm: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pkgm	With mpm
List what’s installed	pkgm list	mpm --pkgm installed
List outdated packages	pkgm outdated	mpm --pkgm outdated
Install a package	pkgm install <package_id>	mpm install pkg:pkgm/<package_id>
Upgrade everything	pkgm update	mpm --pkgm upgrade --all
Remove a package	pkgm uninstall <package_id>	mpm remove pkg:pkgm/<package_id>

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported
installed	✅
outdated	✅
orphans
search
install	✅
upgrade
upgrade_all	✅
remove	✅
sync
cleanup
doctor

Configuration

• Ignore pkgm on the mpm CLI by passing the --no-pkgm option.

• Ignore it for every run in your configuration:

  [mpm]
  pkgm = false
  

• Raise the timeout of all pkgm calls:

  [mpm.overrides.pkgm]
  timeout = 900
  

• Run mpm config-template pkgm to print all overridable settings for your configuration file:

  [mpm.overrides.pkgm]
  cli_names = [
      "pkgm",
  ]
  cli_search_path = []
  dry_run = false
  ignore_auto_updates = true
  plan = false
  post_args = []
  pre_args = []
  pre_cmds = []
  stop_on_error = false
  unmaintained = false
  version_cli_options = [
      "--version",
  ]
  version_regexes = [
      "pkgm[ \\t]+(?P<version>\\S+)",
  ]
  

Recipes

A few jobs you would otherwise script around pkgm, one mpm command each:

• Snapshot and clone a machine: mpm --pkgm dump pkgm.toml, then mpm restore pkgm.toml on the next one.

• Export a compliance SBOM: mpm --pkgm sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown

State of pkgm’s release-age gating, from the cooldown support table:

Status: ❌ None (pkgx pantry, no publication date on any surface)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: pkgx pantry (dist.pkgx.dev)

• Retraction: Pantry edit: a package is a per-platform versions.txt served from the distribution host, so a version is withdrawn by dropping its line and ceasing to serve the tarball behind it

• Publish date: ❌ no surface prints a publication date, the distribution index listing versions alone

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the bundled definition. If you know pkgm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pkgm list
~/.local/pkgs/stedolan.github.io/jq/v1.8.2
~/.local/pkgs/github.com/kkos/oniguruma/v6.9.10

$ pkgm outdated
stedolan.github.io/jq is outdated 1.7.1 < 1.8.2 /root/.local/pkgs/stedolan.github.io/jq/v1.7.1

Version check

The version is probed by running:

$ pkgm --version
pkgm 0.12.2

and extracted with:

r"pkgm[ \t]+(?P<version>\S+)"

Upstream project

Metrics	pkgxdev/pkgm
Activity
Popularity
Metadata

Changelog

• 8.0.0 (2026-09-20)

  • Add the pkgm package manager with inventory, outdated, install, remove and full upgrade support.