deb-get

ID

deb-get

Home page

https://github.com/wimpysworld/deb-get

Platforms

🐧 Linux

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · sync · cleanup

purl types

pkg:deb-get

CLI name

deb-get

Issues and PRs

📦 manager: dpkg-based

Source

meta_package_manager/managers/deb_get.py

deb-get installs third-party software on Debian and Ubuntu via .deb packages sourced from GitHub releases, direct URLs, and PPAs.

Note

deb-get wraps apt under the hood for actual package installation and removal, so all operations that modify the system require sudo.

Caution

deb-get list --installed prints bare package names with no versions, so the installed inventory carries no version. search is likewise version-less and offers no exact or extended mode, so mpm refilters its results.

Note

There is no read-only outdated: detection runs deb-get update, which also refreshes the package index, so the probe escalates through sudo like a sync.

What mpm adds to deb-get

Through mpm, deb-get gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover deb-get alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your deb-get commands, in mpm

You already know deb-get: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With deb-get

With mpm

List what’s installed

deb-get list --installed

mpm --deb-get installed

List outdated packages

sudo deb-get update

mpm --deb-get outdated

Search for a package

deb-get search zoom

mpm --deb-get search zoom

Install a package

sudo deb-get install ipscan

mpm install pkg:deb-get/ipscan

Upgrade one package

sudo deb-get install ipscan

mpm --deb-get upgrade ipscan

Upgrade everything

sudo deb-get upgrade

mpm --deb-get upgrade --all

Remove a package

sudo deb-get remove ipscan

mpm remove pkg:deb-get/ipscan

Clear caches

sudo deb-get clean

mpm --deb-get cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

orphans

search

✓

exact and extended search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

✓

cleanup

✓

doctor

Selecting and configuring deb-get

Deselect deb-get for a single run with --no-deb-get, or persist the choice in your configuration:

[mpm]
deb-get = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.deb-get]
timeout = 900

mpm config-template deb-get prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around deb-get, one mpm command each:

  • Snapshot and clone a machine: mpm --deb-get dump deb-get.toml, then mpm restore deb-get.toml on the next one.

  • Export a compliance SBOM: mpm --deb-get sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of deb-get’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)

  • Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)

  • Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is extracted from the output of deb-get version with:

r"(?P<version>\d+\.\d+\.\d+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know deb-get well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ deb-get list --installed
activitywatch
anydesk
bitwarden
deb-get
freeplane
google-chrome-stable
ipscan
protonvpn
zoom

$ sudo deb-get update
Checking for updates to deb-get installed packages
  [+] ipscan (3.9.2) has an update pending. 3.9.3 is available.

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --deb-get installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 6.3.0 (2026-04-09)

    • Add deb-get package manager with installed, outdated, search, install, upgrade, remove, sync, and cleanup support. Closes #1609.