Arch Linux yay

AUR helper wrapping pacman, driven through the yay binary.

Inherits every operation, parser and forced argument from Pacman; the binary, version probe and the release-age cooldown below are what differ. Its own --query --upgrades reports AUR updates on top of the official repositories.

Unlike pacman, the helper must run as the regular user: yay warns under root (Avoid running yay as root/sudo.) and any AUR build then dies in makepkg, which refuses to run as root. yay drives sudo itself for the privileged steps (its --sudo, --sudoflags and --sudoloop options), so mpm never wraps it in sudo. That also keeps the injected XDG_CONFIG_HOME cooldown overlay below visible to yay, where a sudo wrap would have reset the environment.

Note

yay exposes no release-age flag, so mpm enforces the supply-chain cooldown by overlaying a generated init.lua through a private XDG_CONFIG_HOME (see Yay.cooldown_env()). This needs yay >= 13.0.0, when the Lua UpgradeSelect/AURPreInstall hooks landed; an older yay stays a usable manager but cannot honor a cooldown. The upstream request for a less invasive injection point is https://github.com/Jguer/yay/issues/2883.

Platforms

  • 🅱️ BSD

  • 🐧 Linux

  • ⨂ Unix

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

search

✓

extended search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

✓

cleanup

✓

Ecosystem

  • Accepted purl types: pkg:alpm, pkg:yay

Usage

$ mpm --yay installed
$ mpm --yay search "query"
$ mpm --yay upgrade --all
$ mpm install pkg:yay/hello
$ mpm --dry-run --yay upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-yay, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line

  • CLI names, in lookup order: yay

  • Arguments forced before each call: --noconfirm --color never

The version is probed by running:

$ yay --version
yay v11.1.2 - libalpm v13.0.1

and extracted with:

r"yay\s+v(?P<version>\S+)"

Privilege escalation

Arch Linux yay runs sudo from inside its own commands: mpm never wraps it, keeps an already-warm credential cache alive for those internal escalations, and warns when a mutating call goes silent on a terminal with a cold cache, since a password prompt may be hiding in the stream.

See privilege escalation for the full policy.

Cooldown

mpm natively enforces its release-age cooldown on Arch Linux yay, injecting the XDG_CONFIG_HOME environment variable on every call.

  • Status: ✅ Enforced (yay ≥ 13.0)

  • Mechanism: generated init.lua overlay via XDG_CONFIG_HOME (UpgradeSelect + AURPreInstall hooks)

  • Reference: Jguer/yay#2883