Sorcery

Note

Source Mage is a small, slow-moving distribution; its sorcery scripts still receive commits but formal releases are rare.

ID

sorcery

Home page

https://sourcemage.org

Platforms

🐧 Linux (Source Mage GNU/Linux only)

Operations

installed · search · install · upgrade · upgrade_all · remove · sync · cleanup

purl types

pkg:sorcery

CLI name

sorcery

Issues and PRs

📦 manager: sorcery

Source

meta_package_manager/managers/sorcery.toml

Sorcery is Source Mage GNU/Linux’s source-based package manager, a suite of bash tools: sorcery itself plus gaze (queries), cast (install), dispel (remove), scribe (grimoire sync) and cleanse (cleanup).

Parsing notes, verified against the sorcery source (usr/sbin/sorcery, usr/sbin/gaze, var/lib/sorcery/modules/libstate, and the gaze/cast/dispel/scribe/cleanse man pages):

• gaze is the only read-only, non-root binary; its global -q flag (before the subcommand) forces PAGER=cat and drops the human “query -> “ prefix, so the regexes see clean unpaged text.

• gaze installed dumps the spell status file: one “spell:YYYYMMDD:status:version” line per record, with status one of installed/held (exiled lines are filtered out by gaze itself). The file is append-only, so a spell upgraded in place may briefly show duplicate lines.

• Every mutating operation needs root: when not root, sorcery re-execs itself through su, which would block mpm’s non-interactive subprocess. Marking the operations sudo = true routes them through mpm’s own escalation instead.

• No outdated: sorcery queue requires root, rewrites the queue state file and ends on an interactive “edit the queue?” prompt, so there is no cleanly non-mutating upgradable listing.

• cast compiles from source and may prompt on a spell’s first cast (optional dependencies, configuration); sorcery has no universal --yes flag.

What mpm adds to sorcery

Through mpm, sorcery gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover sorcery alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your sorcery commands, in mpm

You already know sorcery: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With sorcery	With mpm
List what’s installed	gaze -q installed	mpm --sorcery installed
Search for a package	gaze -q search -name <query>	mpm --sorcery search <pkg>
Install a package	cast <package_id>	mpm install pkg:sorcery/<package_id>
Upgrade one package	cast <package_id>	mpm --sorcery upgrade <package_id>
Upgrade everything	sorcery upgrade	mpm --sorcery upgrade --all
Remove a package	dispel <package_id>	mpm remove pkg:sorcery/<package_id>
Clear caches	cleanse --sweep	mpm --sorcery cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync	✓
cleanup	✓
doctor

Selecting and configuring sorcery

Deselect sorcery for a single run with --no-sorcery, or persist the choice in your configuration:

[mpm]
sorcery = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.sorcery]
timeout = 900

mpm config-template sorcery prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around sorcery, one mpm command each:

• Snapshot and clone a machine: mpm --sorcery dump sorcery.toml, then mpm restore sorcery.toml on the next one.

• Export a compliance SBOM: mpm --sorcery sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

Root is required for its cleanup_cache, install, remove, sync, upgrade, upgrade_all operations.

See privilege escalation for the full policy.

Cooldown

State of Sorcery’s release-age gating, from the cooldown support table:

Status: ❌ None (Source Mage, source-based)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Source-based recipe trees

• Retraction: Index revert of the recipe tree

• Publish date: ❌ a recipe carries no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ sorcery --version
20240108

and extracted with:

r"^(?P<version>[\d.]+)$"

Reference traces

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Sorcery well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ gaze -q installed
cowsay:20240108:installed:3.03
vim:20230101:held:9.0

$ gaze -q search -name {query}
cowsay 3.03 @test
tree 2.1.1 @stable

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --sorcery installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 7.2.0 (2026-07-09)

  • Add Sorcery (Source Mage GNU/Linux) package manager with installed, search, install, upgrade, remove, sync and cleanup support; a bundled configuration-defined manager.