Zero Install¶

ID: zeroinstall
Links: Home page · Documentation · Repository
Upstream stars: ⭐ 579
Last commit: 2026-06-04
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: search · remove · cleanup
purl types: pkg:zeroinstall/
CLI name: 0install
Every call: 0install --console <command>
Issues and PRs: 📦 manager: zeroinstall
Source: zero_install.py

Zero Install is a decentralised, cross-platform installation system.

There is no central registry. A program is identified by the URL of its feed, an XML document its own publisher hosts and signs with their own GPG key, so a package id here is a feed URI rather than a short name. Short names collide freely across publishers: one search for python returns a Python feed from apps.0install.net, another from 0install.de and a third from dispcalgui.hoech.net.

A second identifier sits beside the URI. An application is a pet name the user invents and binds to a feed, which is what destroy and update address. The two identifier spaces are what shape the operation set below.

What `mpm` adds to `zeroinstall`¶

Through mpm, zeroinstall gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover zeroinstall alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `zeroinstall` commands, in `mpm`¶

You already know zeroinstall: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `zeroinstall`	With `mpm`
Search for a package	`0install search hello`	`mpm --zeroinstall search hello`
Remove a package	`0install destroy zeroinstall`	`mpm remove pkg:zeroinstall/destroy`
Clear caches	`0install store optimise`	`mpm --zeroinstall cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	❌	The `0install list` inventory is the set of cached feeds, not the set of installed programs.
`outdated`	❌	Nothing reports staleness without acting on it; `update` is the upgrade itself.
`orphans`
`search`	✅	Exact and extended search backfilled by `mpm`.
`install`	❌	The `0install add` command takes a pet name and a feed URI, and `mpm` cannot invent one for the user.
`upgrade`	❌	A single-package upgrade could never be dispatched: `mpm` resolves the source manager by querying an inventory this manager has none.
`upgrade_all`	❌	The tool takes one application or URI per update, and ships no bulk form.
`remove`	✅
`sync`	❌	Refreshing is the `--refresh` flag of the commands that resolve a feed, never a command of its own.
`cleanup`	✅
`doctor`

Configuration¶

Ignore zeroinstall on the mpm CLI by passing the --no-zeroinstall option.
Ignore it for every run in your configuration:
```
[mpm]
zeroinstall = false
```

Raise the timeout of all zeroinstall calls:

[mpm.overrides.zeroinstall]
timeout = 900

Run mpm config-template zeroinstall to print all overridable settings for your configuration file:

[mpm.overrides.zeroinstall]
cli_names = [
    "0install",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "--console",
]
pre_cmds = []
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "0install\\s+\\(zero-install\\)\\s+(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every zeroinstall call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around zeroinstall, one mpm command each:

Snapshot and clone a machine: mpm --zeroinstall dump zeroinstall.toml, then mpm restore zeroinstall.toml on the next one.
Export a compliance SBOM: mpm --zeroinstall sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of Zero Install’s release-age gating, from the cooldown support table:

Status: ❌ None (dates are author-written in a publisher-hosted feed)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Publisher-hosted signed feeds
Retraction: Feed edit: no index stands between a name and the code, a program being an XML feed its own publisher hosts and signs, so a version is withdrawn by that publisher dropping its implementation element and re-signing the document
Publish date: ❌ a feed’s released attribute is written by the publisher into the document they sign, so it is author-set

Version check¶

The version is probed by running:

$ 0install --version
0install (zero-install) 2.18
Copyright (C) 2019 Thomas Leonard
This program comes with ABSOLUTELY NO WARRANTY,
to the extent permitted by law. You may redistribute copies of this program
under the terms of the GNU Lesser General Public License.
For more information about these matters, see the file named COPYING.
Compiled with D-Bus support: false
HTTP client library: libcurl (C)

and extracted with:

r"0install\s+\(zero-install\)\s+(?P<version>\S+)"

Upstream project¶

Metrics	`0install/0install`
Activity
Popularity
Metadata

Changelog¶

8.1.0 (2026-10-04)
- Fix remove exiting on “No manager selected” when the only manager selected keeps no inventory: that manager now gets the package as is.
8.0.0 (2026-09-20)
- Add the Zero Install package manager with search, remove and cache cleanup support.