PKG(8) System Manager's Manual PKG(8)

pkg — package manager for rawnix.org

pkg [-bfNvy] [-r root] command [argument ...]

pkg -h | -V

pkg installs, upgrades and removes packages together with their dependencies. It builds a package with mkpkg -d in the port directory, or fetches it with bulk(8), installs it with addpkg(8) and removes it with delpkg(8). For every installed package it records whether it was installed on request or as a dependency, so that autoremove can remove dependencies nothing needs any more.

Options may also follow the command. The options are as follows:

, --use-bulk
Fetch pre-built packages with bulk(8) instead of building, for add, update and sysup. A port with a MAKEPKG.lock is never fetched: it is built from the lock, and its build dependencies are fetched. If a fetch fails, nothing is built in its place.
, --force
With del, remove a package even though installed packages depend on it.
, --help
Print a usage summary.
, --no-deps
With add and update, build or fetch and install only the named package, without resolving its dependencies.
root, --root root
Install into, and read the package databases of, root instead of /. Ports, configuration and builds are those of the running system.
, --version
Print the version.
, --verbose
With prepare, print the port's dependencies first.
, --yes
Answer yes to every confirmation. A package that has variants is then an error, since the choice cannot be made for you.

port ...
Install each port with its dependencies, in the order given, and stop at the first failure. A package already installed at its port's version is left alone. Either way it is recorded as installed on request.

If ports named port-suffix declare a variant, the choices are listed and one is asked for; see PORTS.

package ...
Remove each installed package. A package is not removed if it is locked, or if an installed package depends on it and -f is not given. The other packages are still removed. Afterwards the orphaned packages are listed.
package ...
Update each installed package, with its dependencies, to its port's version. Unlike add, it keeps the reason the package was installed for. It stops at the first failure.
Update every installed package whose version differs from its port. Packages without a port, and locked packages without a MAKEPKG.lock, are left alone. The list is shown for confirmation, then worked through in order of runtime dependencies. With -b, bulk -u runs first. A package that fails is reported and skipped, and the others are still updated.
Remove the orphaned packages, after confirmation. Locked packages are kept.

[port]
Build the package of port without installing it, unless it is already built. Without port, the port is named by the MAKEPKG in the current directory.
[port]
Install everything port needs to be built: its runtime and build dependencies, but not the port itself. Installed dependencies whose version differs from their port are updated first. New packages are recorded as dependencies, so autoremove removes them once nothing needs them. Without port, the port in the current directory is used.
port ...
Fetch the packages of each port and its runtime dependencies with bulk(8), without installing them. Locked ports are not fetched; for those that must be built, their build dependencies are.

List the installed packages with their versions.
package
Print the name and version of package if it is installed, and exit 1 if it is not.
List the installed packages whose version differs from their port. A locked package without a MAKEPKG.lock is marked [locked]. For a port with a MAKEPKG.lock, the line is marked [MAKEPKG.lock], and upstream version is added when the port's MAKEPKG has moved on.
port
Print the depends and makedeps of the port's recipe. Only the direct dependencies are shown.
package
List the packages whose runtime dependencies include package.
List the orphaned packages: those installed as a dependency that no installed package depends on any more, directly or through other orphans.

package
Lock an installed package. The port's MAKEPKG, .footprint and .signature are copied to MAKEPKG.lock, .footprint.lock and .signature.lock, which ports(8) never changes. An existing MAKEPKG.lock is kept.

pkg and mkpkg(8) use MAKEPKG.lock whenever it exists. Upstream changes to the port are therefore ignored, while edits to MAKEPKG.lock are built and installed by add, update, sysup and prepare.

If the package has no port, only the installed version is pinned: it is never upgraded, and add refuses it.

Locked packages are never removed by del or autoremove.

package
Unlock package and remove the three lock files from its port.
List the locked packages with their installed versions. Where the recipe's version differs, it is added as -> lock version or, without a MAKEPKG.lock, -> repo version. [stale] marks a package that is no longer installed, [no MAKEPKG.lock] a port without the lock file.

Add every installed package that the dependency database does not know yet, as installed on request, and fill in missing dependency lists from the ports. The first pkg command run with an empty database does this by itself.
Report entries for packages that are no longer installed, and installed packages that are not in the database, and offer to remove the former.

Same as -h.
Same as -V.

A port is a directory holding a MAKEPKG, or only a MAKEPKG.lock, in one of the port directories of pkg.conf(5). Its name is the directory's name, and the recipe's name must be the same: the package file is found by that name. A port where they differ is refused with an error. If two port directories have a port of the same name, the one listed later is used.

pkg reads the recipe that mkpkg(8) builds: MAKEPKG.lock if it exists, otherwise MAKEPKG. Besides name, version and release it uses these arrays, described in MAKEPKG(5):

depends
Needed at run time. Always installed with the package, and recorded in the dependency database.
makedeps
Needed only to build. Installed only for a package that has to be built, that is, not already built and not fetched with -b.
provides
Other names this port satisfies as a dependency. A dependency on such a name is met by an installed port providing it; if none is installed, a providing port is installed.
variant
A one-line description. A port name-suffix that sets it is offered as a variant of name by add.

A package counts as built if the file name#version-release.pkg.tar.ext exists in the package directory MKPKG_PACKAGE_DIR of /etc/mkpkg.conf, or in the port directory.

Installed dependencies whose version differs from their port are updated before the package that needs them. Packages without a port, such as a kernel built from /usr/src, and locked packages without a MAKEPKG.lock are used as they are.

When dependencies form a cycle, packages in it that are already installed are rebuilt against the installed versions of the others. A cycle through a package that is not installed is an error.

Commands that change the system or a database take the lock /var/lib/pkg/pkg.lock and wait for another pkg holding it. Queries do not.

/etc/pkg.conf
Port directories; see pkg.conf(5).
/etc/mkpkg.conf
Read for MKPKG_PACKAGE_DIR and MKPKG_COMPRESSION_MODE; see mkpkg.conf(5).
/var/lib/pkg/db
Package database, written by addpkg(8) and delpkg(8).
/var/lib/pkg/deps.db
Dependency database: why each package was installed, and its runtime dependencies.
/var/lib/pkg/locked
Locked packages.
/var/lib/pkg/pkg.lock
Instance lock.

The pkg utility exits 0 on success, and >0 if an error occurs. del, sysup and autoremove fail if any package failed.

Install with dependencies, then remove:

# pkg add firefox
# pkg del firefox

Update the whole system from pre-built packages without asking:

# pkg -by sysup

Install the build dependencies of the port in the current directory:

# pkg prepare

Keep rust at its current recipe:

# pkg lock rust

MAKEPKG(5), mkpkg.conf(5), pkg.conf(5), addpkg(8), bulk(8), delpkg(8), infopkg(8), mkpkg(8), ports(8), revdep(8)

With -r, bulk -u in sysup -b still compares against the running system's package database.

September 27, 2026 pkg 1.4.0