Rusty ALPM

A native-Rust Arch package manager — one GUI + CLI to search and manage software from the official repos, the AUR, Flatpak, and AppImage, talking to libalpm directly.

rusty-alpm is a feature-faithful re-creation of Shelly (the C#/.NET GTK4 Arch package manager) with its own modern visual identity built in iced. It unifies four package sources behind one search, talks to libalpm directly (it is not a pacman wrapper), and isolates all root work to one tiny pkexec'd worker binary.

The ralpm command is the CLI; ralpm-gui is the desktop app.

Table of Contents

• Background
• Architecture
• Install
• Usage
• Security model
• Development
• Maintainers
• Contributing
• License

Background

Arch users juggle several package sources — the official repos, the AUR, Flatpak, and AppImage — each with its own tool. Rusty ALPM brings all four into one search and one transaction view, with a non-blocking UI that stays responsive even during a hundreds-of-packages "update all". The full architecture is the source of truth in docs/superpowers/specs/2026-06-25-rusty-alpm-design.md; the milestone plan that builds it is ROADMAP.md.

Architecture

Five crates, with the only root code isolated to one of them:

Crate	Kind	Role
ralpm-ipc	lib	The serializable privilege-boundary protocol (TransactionPlan, ProgressEvent, WorkerError). Data only.
ralpm-core	lib	All unprivileged work: package model, the SourceProvider trait, search/info/resolve, plan-building. No iced/clap.
ralpm-worker	bin	The only code that runs as root. pkexec'd, short-lived; validates a plan and runs the libalpm commit.
ralpm-gui	bin	The iced desktop app. Unprivileged; spawns the worker for writes.
ralpm-cli	bin	The ralpm command (clap). Same core, same worker spawn.

Install

Status: 1.11.0 — feature-complete across all four sources (M0–M15, plus the post-1.0 browse-all). The GUI design refresh (Phase G, M16–M25 → 1.11.0) is feature-complete: M16 ✅ shipped the theme/typography foundation + the theme//components//view/ module split; M17 ✅ the client-side-decoration shell (header + sidebar + rounded frame + resize) and the reusable styled-component library; M18 ✅ re-skinned the Browse screen (source filter chips, Ctrl+K search focus, clickable result rows) and the Detail screen (Overview / Dependencies / Files / Versions tabs, satisfied-state dependency chips, and a metadata rail); M19 ✅ the apply flow — a pending-changes queue, the plan/conflict resolver (dependency tree, replacement/conflict banners with resolution radios, net-effect summary), and the re-skinned transaction view, with the single pkexec still scoped to the reviewed plan; M20 ✅ the AUR Review + Build screens — an amber caution band, the tinted PKGBUILD, an AUR trust rail (votes/popularity/maintainer/last-updated/out-of-date), the "I've read the PKGBUILD" checkbox gate, and per-base build outcomes with the partial-build gate; M21 ✅ re-skinned the Updates screen (summary, select-all + per-row repo selection, old → new rows, ↻ reboot flag) and built the net-new Installed view (explicit/dependency/orphan/foreign classification with filter chips and an orphan-cleanup bar that reuses the existing commit path); M22 ✅ re-skinned the Settings screen as libadwaita-style grouped cards (theme/update-schedule segmented controls, notifications toggle, per-source toggles, a parallel-downloads slider, and a cache-clear action) and added the net-new first-run welcome and no-results empty state (with a one-press AUR-search nudge); M23 ✅ added mirror management — a Settings › Mirrors sub-page that ranks the system mirrorlist by latency / throughput / freshness and applies a re-ranked list to /etc/pacman.d/mirrorlist through the privileged worker (the first new privileged write since 1.0, reviewed by a reserved outside voice); M24 ✅ added transaction history + guarded rollback — an append-only journal in ralpm.db records every successful commit across all four sources, the net-new History view renders the timeline (kind-coloured dots, per-package delta), and a guarded Roll back reverses a repo transaction from the package cache through the worker, which re-validates every cache file + signature before any privileged step (the second new privileged action, reviewed by a reserved outside voice); M25 ✅ the consistency pass that closes Phase G — every screen audited against the vendored design standard (exact dark-theme token fidelity, light/dark parity, a WCAG 2.1 contrast pass where all primary/secondary text clears AA, and a render-path check confirming the paged window holds), recorded in docs/design/CONSISTENCY-AUDIT-M25.md. Phase H — The Catalogue (M26–M39) is the active roadmap arc: full catalogue browse across all four sources (icons, categories, screenshots), a Home dashboard with Arch news, the system-maintenance suite (DB sync, cache clean, downgrade, local install), daemonless update notifications, and snapshot export/import — see ROADMAP.md. 2.0.0 is the owner's sign-off-gated cut after M39. Targets Arch and Arch-based distros (developed on CachyOS; pacman 7.1, libalpm.so.16).

A PKGBUILD lives in packaging/ and installs the GUI + CLI plus the root-owned, polkit-gated worker and desktop integration:

cd packaging
makepkg -si        # build (release) + run the check suite + install

It installs ralpm-gui and ralpm to /usr/bin, the only root binary (ralpm-worker) to /usr/lib/ralpm/ralpm-worker (root:root 0755), the polkit policy, a .desktop launcher, and the icon. See packaging/README.md for the full layout and the end-to-end smoke test. Until it lands in the AUR, build from source as above (or cargo build --release --workspace).

Usage

# Search every enabled source, then inspect one package
ralpm search media player
ralpm info firefox

# Install / remove (auto-detects the source; --source forces one)
ralpm install firefox             # repo
ralpm install yay --source aur    # AUR (PKGBUILD review, then build as you, not root)
ralpm install org.gnome.Calculator --source flatpak

# Maintenance
ralpm list                        # installed, across sources
ralpm update                      # what's upgradable (does not apply)
ralpm upgrade                     # apply the official-repo upgrades

# Desktop app
ralpm-gui

Every list command emits a stable, tab-separated line per item (no header), so it pipes cleanly into cut/awk. Run ralpm --help (or ralpm <command> --help) for the full grammar.

Security model

• Unprivileged by default; one root binary. Only ralpm-worker ever runs as root (via pkexec). The GUI and CLI never do. There is no persistent daemon.
• IPC is data-only. The protocol carries packages, never shell commands or paths-to-execute. The worker acts on a plan solely through libalpm APIs.
• The worker trusts nothing. Every plan is validated before any privileged action (path canonicalization, sync-DB membership, signature verification stays on).
• makepkg never runs as root. AUR builds are user-space; only the final install is privileged.

Development

Requires Rust 1.96 (pinned via rust-toolchain.toml; edition 2024).

cargo build --workspace
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all --check

Maintainers

Alan Gaudet (alan.c.gaudet@gmail.com).

Contributing

Issues and pull requests are welcome on Codeberg (primary) or GitHub (mirror). This project follows standard-readme and Keep a Changelog.

License

GPL-3.0-or-later © Alan Gaudet.

Rusty ALPM links the system libalpm (GPL-2.0-or-later) and, for Flatpak support, the system libflatpak (LGPL-2.1-or-later) via its MIT-licensed gir bindings. GPL-3.0-or-later is compatible with dynamically linking both, so no part of the dependency tree forces a licence change.