SafeITExperts

SafeITExperts

Your expert guide to cybersecurity and digital privacy. Security hardening for all platforms : Windows, macOS, Linux, and Android. Solutions aligned standards : NIST and ANSSI for comprehensive digital protection.


Arch Linux Pacman: Complete Guide & Tutorial

Publié par Marc sur 3 Mars 2026, 15:34pm

Catégories : #HDMI 2.1, #DisplayPort 1.4

Arch Linux Pacman: Complete Guide & Tutorial
HDMI & DisplayPort on Laptop : Complete Ultrawide 34" 3440×1440 Guide | SafeITExperts
Search
Menu

Arch Linux Pacman: Complete Guide & Tutorial

🚀 From Beginner to Expert — Everything you need to know about Arch Linux package management
2026 Updated: 02/28/2026 Read: 20 min 2 Parts
📦 pacman 🐧 Arch Linux 🔄 Rolling Release 🛠️ paru ⚙️ AUR 🏗️ makepkg
1
Global Overview of Pacman

📖 Preamble

In the Arch Linux ecosystem — a pure rolling release distribution — pacman (Package Manager) is the central software management tool. It natively handles official repositories, automatically resolves dependencies, and relies on the .pkg.tar.zst format for package handling. For AUR (Arch User Repository) access, complementary tools like yay or paru are layered on top.

Arch Linux Pacman Package Management
About this guide

This guide uses Arch Linux (rolling release, core , extra , multilib repositories) as its base, with testing repositories ( core-testing , extra-testing ) and the AUR as supplementary sources. All commands are verified for an up-to-date standard Arch system (February 2026), running pacman 7.1.0 (November 2025).

Goal

Master pacman progressively, from beginner to expert, with concrete practical cases and verified commands.

👥 Target Audience

🌱
Beginner
Get up and running quickly
Sections: Starter Pack
🌿
Intermediate
Understand repos, priorities, updates
Sections: Concepts & Practices
🌳
Expert
Troubleshooting, AUR, sensitive commands
Sections: Advanced & Critical

📚 How to Read This Guide

Level Content Recommendation
🟢 Essential Common commands, examples Master these first
🟠 Intermediate Concepts, workflows To deepen your knowledge
🔴 Expert Critical cases, AUR, advanced operations For experienced users

❓ What is Pacman?

Element Description
Role Native package manager of Arch Linux
Engine Written in C, libalpm library, .pkg.tar.zst format
Strengths Rolling release, dependency resolution, AUR via helpers, speed
Current version 7.1.0 (November 2025)
Audience All Arch users, from beginners to administrators

📝 Basic Syntax

General structure

pacman syntax
pacman [OPTIONS] OPERATION [TARGETS]
yay [OPTIONS] OPERATION [TARGETS] # AUR helper (pacman wrapper)
paru [OPTIONS] OPERATION [TARGETS] # AUR helper — recommended 2026

Breakdown

Element Role Example
OPERATION Main action (uppercase letter) -S , -R , -Q , -U
OPTIONS Operation modifiers -y , -u , -s , -i
TARGETS Package name, file, pattern htop , ./pkg.tar.zst

Annotated example

Example
# Install htop without reinstalling if already up to date
$ sudo pacman -S --needed --noconfirm htop
# -S = Sync operation (install/search repos)
# --needed = skip reinstall if already up to date
# --noconfirm = no interactive confirmation (scripts/automation)
# htop = target (package)
Arch particularity

Pacman uses letter flags ( -S , -R , -Q …) where APT uses verbose subcommands ( install , remove , search …).

🧩 Difference between pacman , yay and paru

Tool Main role Language Audience
pacman Official management (core/extra/multilib) C Daily use + scripts
yay Pacman wrapper + AUR (Yet Another Yaourt) Go Good choice, simple interface
paru Pacman wrapper + AUR, built-in PKGBUILD review Rust Recommended 2026 — more actively maintained
makepkg Manual compilation from PKGBUILD Bash Manual AUR build / low level
Recommendation

paru is more actively maintained in 2026, forces a PKGBUILD review before installation, and supports building in a clean chroot ( --chroot ). Recommended at all levels.

🏗️ Internal Architecture: pacman + AUR

┌────────────┐     ┌──────────────────┐     ┌──────────────────┐
│   pacman   │ ──► │  libalpm (lib)   │ ──► │  Système Linux   │
└────────────┘     └──────────────────┘     └──────────────────┘
      │                    │                        │
      ▼                    ▼                        ▼
CLI Interface     Install/remove             File management
Repo management   Local database             Pre/post-transaction hooks
Dependency        /var/lib/pacman/           Sandbox (NO_NEW_PRIVS)
resolution

┌────────────┐     ┌──────────────────┐
│  yay/paru  │ ──► │   AUR + pacman   │
└────────────┘     └──────────────────┘
      │
      ▼
Downloads PKGBUILD ► makepkg ► pacman -U

Component roles

Component Role Importance
pacman User interface, official repo management, resolution Daily interaction
libalpm Underlying C library, transactional core System core
/var/lib/pacman Local database of installed packages System integrity
yay / paru AUR access + pacman wrapping Extensibility
makepkg Compiles PKGBUILDs into .pkg.tar.zst AUR/custom build

🆕 Pacman 7.1.0 — Major Changes (November 2025)

Security & Sandbox

Feature Description Impact
NO_NEW_PRIVS Downloads run without possibility of privilege escalation Reduces attack surface during installs
Enhanced syscall filtering Restricts system calls in the download process Stricter sandbox for libalpm
Fine-grained sandbox options New directives in pacman.conf and CLI Customizable sandbox level

makepkg — build improvements

Feature Description
NPROC dans makepkg.conf Controls build operation parallelism
Parallelized stripping Reduces build time for large packages
options_$arch dans PKGBUILD Architecture-specific options in PKGBUILDs
Source reproducibility Source tarballs generated reproducibly

repo-add — new flags

repo-add
repo-add --wait-for-lock # Handles concurrent updates without conflicts
repo-add --remove # Automatically removes old package files
pacman.conf migration

If you maintain an older config, check sandbox option compatibility after upgrading to 7.1.0 with man pacman.conf .

📦 Repositories

Repository roles: the foundation

Repositories are defined in /etc/pacman.conf .

┌─────────────────────┐
│        core         │  (base system, boot, network, build tools)
└─────────────────────┘
          │
┌─────────────────────┐
│        extra        │  (Xorg, DE, browsers, Python, Ruby…)
│  [former community, │   merged August 2023
└─────────────────────┘
          │
┌─────────────────────┐
│      multilib       │  (32-bit libs, Steam) — disabled by default
└─────────────────────┘
          │
┌─────────────────────┐
│  core/extra-testing │  (pre-releases, tests — experts only)
└─────────────────────┘
          │
┌─────────────────────┐
│        AUR          │  (Arch User Repository — unofficial)
└─────────────────────┘

Types de dépôts

Type Content Notes
core Fundamental packages (boot, network, build) Maximum quality, signoffs required
extra Everything else — formerly community merged August 2023 Maintained by Arch Package Maintainers
multilib 32-bit libs and apps (Steam, Wine…) Disabled by default, enable in pacman.conf
core-testing Candidats pour core ⚠️ Must enable alongside extra-testing
extra-testing Candidats pour extra ⚠️ Must enable alongside core-testing
gnome-unstable GNOME alphas/betas Reserved for GNOME testers
kde-unstable KDE Plasma and Applications betas/RCs Reserved for KDE testers
staging Packages being rebuilt ⛔ Never enable — internal dev use only
AUR Paquets communauté (PKGBUILD) Unofficial — via paru/yay/makepkg only

Enable multilib

/etc/pacman.conf
# /etc/pacman.conf — uncomment:
[multilib]
Include = /etc/pacman.d/mirrorlist

Then: sudo pacman -Syu

Enable kde-unstable

/etc/pacman.conf — add AT THE TOP
[kde-unstable]
Include = /etc/pacman.d/mirrorlist
# Required simultaneously:
[core-testing]
Include = /etc/pacman.d/mirrorlist
[extra-testing]
Include = /etc/pacman.d/mirrorlist

Best practices by use case

Context Recommended repos Discouraged repos
Standard desktop core , extra staging — toujours
Gaming / Steam core , extra , multilib staging
KDE tester core , extra , core-testing , extra-testing , kde-unstable staging
GNOME tester core , extra , core-testing , extra-testing , gnome-unstable staging
Server core , extra multilib , testing , AUR

⚖️ Repository Priorities

Pacman does not have a fine-grained pinning system like APT. Priority is determined by the order of sections in /etc/pacman.conf : the repository listed first wins in case of name conflict.

pacman needs to install a package:
        │
        ▼
1. Repository listed FIRST in pacman.conf
        │
        ▼
2. Most recent version (if same repo)
        │
        ▼
3. Résolution des resolution
Exception handling: IgnorePkg

In /etc/pacman.conf , section [options]:

IgnorePkg
IgnorePkg = linux linux-headers # lock the kernel
IgnoreGroup = gnome # lock an entire group
Warning — Partial upgrades are forbidden

Arch does not support partial upgrades. Running pacman -Sy without -u is dangerous and can leave the system in an inconsistent state. Always use pacman -Syu .

🔄 Arch Rolling Release — In 20 seconds

🟢
Stable (core/extra)
Standard Arch rolling

Risks: Low if updated regularly

Usage: Everyone

Routine: pacman -Syu

🟠
Testing
Pre-releases for core/extra

Risks: Moderate

Usage: Arch testers

Routine: Enable in pacman.conf

💥
AUR
Unofficial community

Risks: Variable (PKGBUILD quality)

Usage: Everything not in official repos

Routine: paru -Syu or yay -Syu

2
Pacman Commands

🚀 Starter Pack — The 15 Essential Commands

1
sudo pacman -Syu
Sync and update the entire system
2
sudo pacman -S <pkg>
Install a package
3
sudo pacman -R <pkg>
Remove (keeps dependencies)
4
sudo pacman -Rs <pkg>
Supprimer + resolution orphelines
5
sudo pacman -Rns <pkg>
Supprimer + resolution + fichiers de config
6
pacman -Ss <motif>
Search in repositories
7
pacman -Si <pkg>
Detailed info (repo)
8
pacman -Qi <pkg>
Detailed info (locally installed)
9
pacman -Qs <motif>
Search among installed packages
10
pacman -Qdt
List orphan packages
11
pacman -F <fichier>
Which package provides this file?
12
sudo pacman -Sc
Clean cache (uninstalled versions)
13
sudo pacman -Scc
Clean entire cache ⚠️
14
pacman -Qet
List explicitly installed packages
15
sudo pacman -U ./pkg.tar.zst
Install a local package

📦 Repository Management

Inspecting repositories

Inspect
$ cat /etc/pacman.conf
$ pacman -Sl # list all packages from all repos
$ pacman -Sl extra # list packages from a specific repo
$ pacman -Sl multilib # list multilib packages

Add, modify, remove

Management
# Edit repository configuration
$ sudo nano /etc/pacman.conf
# After changes, always resync:
$ sudo pacman -Syu
# Example: add third-party repo (chaotic-aur)
[chaotic-aur]
Include = /etc/pacman.d/chaotic-mirrorlist

🔍 Advanced Query Commands ( -Q , -S , -F )

Command Description
pacman -Si <pkg> Infos complètes depuis les dépôts (versions, resolution)
pacman -Qi <pkg> Info of locally installed package
pacman -Ql <pkg> List of files installed by a package
pacman -Fl <pkg> List of files in a remote package
pacman -Qo <fichier> Which package owns this file (installed)
pacman -F <fichier> Which package owns this file (repos) — requires pacman -Fy
pacman -Qdt Paquets orphelins (plus requis comme resolution)
pacman -Qet Paquets installés explicitement (non resolution)
pacman -Qmq Foreign packages (AUR, manually installed)
pacman -Qk <pkg> Check file integrity of a package
pacman -T <dep1> <dep2> 🆕 Vérifier si des resolution sont satisfaites (checkdeps — utile en scripting)
pactree <pkg> Arbre de resolution (paquet pacman-contrib )

📥 Install / Update / Remove

pacman -Su vs pacman -Syu vs full upgrade

Criterion -Su -Syu paru -Syu
Sync database ❌ Non ✔️ Oui ✔️ Oui
Updates official packages ✔️ Oui ✔️ Oui ✔️ Oui
Updates AUR packages ❌ Non ❌ Non ✔️ Oui
Recommended use ⛔ Discouraged alone Daily If using AUR

Advanced installation

Installation
# Install multiple packages
$ sudo pacman -S git curl vim
# Install from a specific repository
$ sudo pacman -S extra/firefox
$ sudo pacman -S core/bash
# Install with brace expansion
$ sudo pacman -S plasma-{desktop,nm,pa}
# Reinstall / install only if needed
$ sudo pacman -S --needed bash
# Simulate (dry run)
$ sudo pacman -S --print htop
# Install a local .pkg.tar.zst file
$ sudo pacman -U ./paquet.pkg.tar.zst
# Install from the AUR (via paru — recommended)
$ paru -S nomdupaquet-aur
# Install from AUR manually (without helper)
$ git clone https://aur.archlinux.org/nomdupaquet.git
$ cd nomdupaquet && makepkg -si

Removal

Removal
$ sudo pacman -R htop # keeps dependencies
$ sudo pacman -Rs htop # + resolution non requises ailleurs
$ sudo pacman -Rns htop # + resolution + fichiers de config
$ sudo pacman -Rns $(pacman -Qdtq) # remove all orphans

Locking packages (IgnorePkg)

Locks
# Lock in /etc/pacman.conf:
IgnorePkg = linux linux-headers nvidia
# Check active configuration
$ grep IgnorePkg /etc/pacman.conf
# Force update an ignored package (one-time)
$ sudo pacman -S linux # pacman warns and asks for confirmation

Cache cleanup

Cleanup
# ✅ RECOMMENDED — Keep the last 3 versions
$ sudo paccache -r
# Keep only 2 versions — ideal compromise
$ sudo paccache -rk2
# Remove cached versions of uninstalled packages
$ sudo paccache -ruk0
# Automate via systemd timer (pacman-contrib)
$ sudo systemctl enable --now paccache.timer
# Remove only uninstalled versions
$ sudo pacman -Sc
# ⚠️ NOT RECOMMENDED IN PRODUCTION — Empties ALL cache
$ sudo pacman -Scc
Why prefer paccache over pacman -Scc

paccache is surgical — it keeps a configurable number of previous versions, preserving the ability to downgrade without re-downloading. pacman -Scc is radical and eliminates any possibility of local rollback. On a production system, never use -Scc .

🛠️ Maintenance & Diagnostics

Broken packages / database lock

Diagnostics
# Remove lock (ONLY if no pacman process is running!)
$ sudo fuser /var/lib/pacman/db.lck # check first
$ sudo rm /var/lib/pacman/db.lck # remove only if empty
# Rebuild corrupted GPG keys
$ sudo pacman-key --init
$ sudo pacman-key --populate archlinux
# Force full resync of databases
$ sudo pacman -Syyu

Integrity check

Integrity
$ pacman -Qk <paquet> # quick check
$ pacman -Qkk <paquet> # deep check (checksums)
$ find /etc -name "*.pacnew" # configs to merge manually
$ sudo pacdiff # interactive merge tool (pacman-contrib)
$ pacman -Qmq # foreign packages (AUR, manual)

pacman -T — Dependency checking in scripts 🆕

pacman -T (checkdeps) vérifie si des resolution sont satisfaites sans déclencher aucune transaction — précieuse en scripting et dans les PKGBUILDs.

pacman -T
$ pacman -T "python>=3.11" # returns 0 if OK, lists missing deps otherwise
$ pacman -T curl git wget # vérifier plusieurs resolution d'un coup
# Typical usage in a script:
if ! pacman -T python-requests &>/dev/null; then
sudo pacman -S python-requests
fi
Arch News — Manual interventions after updates

Before each pacman -Syu after a long absence, read the Arch News . News items flag required manual interventions: critical .pacnew files, renamed packages, rebuilds (e.g. NVIDIA 590, .NET, kernel…).

Post-update
$ find /etc -name "*.pacnew" -ls
$ sudo pacdiff # merge interactively
$ systemctl list-units --state=failed
$ sudo lsof | grep 'DEL.*lib'

Dependencies and consistency

Dependencies
$ pactree <paquet> # arbre de resolution (pacman-contrib)
$ pactree -r <paquet> # reverse dependents
$ pacman -Dk # vérifier les resolution non satisfaites

⚡ Advanced Commands (Expert)

Working with testing / unstable repositories

Testing
# Temporarily enable kde-unstable
# Edit /etc/pacman.conf: add [kde-unstable] at the top
# + enable [core-testing] and [extra-testing] simultaneously
$ sudo pacman -Syu
# To revert: comment out the sections, then pacman -Suu

Downgrade — 3 strategies

Downgrade
# Method 1: from local cache
$ sudo pacman -U /var/cache/pacman/pkg/firefox-120.0-1-x86_64.pkg.tar.zst
# Method 2: from Arch Linux Archive (all historical versions)
$ sudo pacman -U "https://archive.archlinux.org/packages/f/firefox/firefox-120.0-1-x86_64.pkg.tar.zst"
# Method 3: downgrade tool (AUR) — RECOMMENDED
$ sudo downgrade firefox
# → interactive list (cache + ALA) → automatically suggests IgnorePkg

Pacman hooks

Hooks run before ( PreTransaction ) or after ( PostTransaction ) transactions.

/etc/pacman.d/hooks/90-mkinitcpio.hook
[Trigger]
Operation = Upgrade
Type = Package
Target = linux
[Action]
Description = Rebuilding initramfs after kernel upgrade...
When = PostTransaction
Exec = /usr/bin/mkinitcpio -P
Note on DKMS and hooks 🆕

-dkms packages (e.g. nvidia-dkms ) include their own automatic hook . Creating a manual DKMS hook is unnecessary. Verify with: pacman -Ql dkms | grep hook

Mirrors: optimize with reflector

reflector
$ sudo pacman -S reflector
$ sudo reflector --country France --protocol https --sort rate --save /etc/pacman.d/mirrorlist
$ sudo pacman -Syu

🔧 Tools Requiring Installation

Tool Role Install
pacman-contrib pactree , paccache , pacdiff , checkupdates sudo pacman -S pacman-contrib
pkgfile Find the package providing a file (repo database) sudo pacman -S pkgfile && sudo pkgfile --update
reflector Automatically optimize the mirrorlist sudo pacman -S reflector
paru Modern AUR helper (Rust) — recommended git clone https://aur.archlinux.org/paru.git && cd paru && makepkg -si
yay AUR helper (Go) — reliable alternative git clone https://aur.archlinux.org/yay.git && cd yay && makepkg -si
downgrade Downgrade easily (cache + ALA, interactive) paru -S downgrade
needrestart Services to restart after update paru -S needrestart
namcap Analyze PKGBUILD quality sudo pacman -S namcap

⚠️ Dangerous Commands — Danger Zone

Warning

Some commands can irreversibly break an Arch system .

Command Danger
pacman -Sy <pkg> (sans -u ) Partial upgrade — #1 cause of broken Arch systems
pacman -Rdd <pkg> Supprime en ignorant les resolution inverses
pacman -Rsc <pkg> Recursive removal of dependents — may take out critical packages
pacman -S --overwrite "*" <pkg> Overwrites all conflicting files — reserved for cases prescribed by Arch News
rm /var/lib/pacman/db.lck Only remove if no active pacman process ( fuser first)
pacman -Scc Empties entire cache → rollback impossible without re-downloading
Activer [staging] Guaranteed broken system — internal dev use only

Best practices

  • Use --print to simulate before applying
  • Back up with timeshift or snapper (Btrfs) before any critical update
  • Read Arch News before pacman -Syu after a long absence
  • Never use pacman -Sy without -u
  • Prefer paccache -rk2 over pacman -Scc

🏆 Top 12 Advanced pacman Commands

1
sudo pacman -Syu
Full system upgrade (ALWAYS with -y and -u)
2
sudo pacman -S extra/<pkg>
Install from a specific repo
3
pacman -Si <pkg>
Voir toutes les infos + resolution (dépôt)
4
pacman -F <fichier>
Find the providing package (repo database)
5
pactree -r <pkg>
View reverse dependents
6
sudo paccache -rk2
Clean cache (keep 2 versions)
7
pacman -T "dep>=version"
Vérifier resolution sans transaction 🆕
8
sudo pacman -Rns $(pacman -Qdtq)
Remove all orphans cleanly
9
pacman -Qo <fichier>
Find which package owns an installed file
10
sudo downgrade <pkg>
Downgrade interactively (cache + ALA)
11
paru -Syu
Update official packages + AUR in one command
12
pacman -Qk <pkg>
Check file integrity of a package

🎯 Advanced Practical Cases (GPS format)

A1
Full system update + AUR
Problem
System + AUR packages need updating
Command
paru -Syu
A2
Fix corrupted GPG keys
Symptom
Invalid signature error during -Syu
Commands
sudo pacman-key --init puis sudo pacman-key --populate archlinux
A3
Install an AUR package manually
Commands
git clone https://aur.archlinux.org/<pkg>.git && cd <pkg> && makepkg -si
A4
Clean downgrade of a broken package
Recommended method
sudo downgrade <pkg>
Cache alternative
sudo pacman -U /var/cache/pacman/pkg/<pkg>-old.pkg.tar.zst
A5
Find the package providing a missing file
Commands
pacman -F /usr/bin/lsmod — then sudo pacman -Fy if database is outdated
A6
Clean up system after package accumulation
Orphans
sudo pacman -Rns $(pacman -Qdtq)
Cache
sudo paccache -rk2 puis sudo paccache -ruk0
A7
Simulate a risky removal
Command
pacman -Rns --print <pkg>
A8
Lock the kernel and NVIDIA
Method
Add to /etc/pacman.conf IgnorePkg = linux linux-headers nvidia
A9
See what depends on python
Commands
pactree -r python ou pacman -Qi python | grep "Required By"
A10
Installer les resolution de build d'un paquet
Command
sudo pacman -S base-devel puis makepkg --syncdeps
A11
Merge .pacnew files after an update
Command
sudo pacdiff (interactive) or find /etc -name "*.pacnew"
A12
Export and restore the package list
Export
pacman -Qeq > pkglist.txt
Restore
sudo pacman -S --needed $(cat pkglist.txt)

🔗 Complete References

Official Arch documentation

Source Content
ArchWiki — pacman Complete reference for the pacman command
ArchWiki — AUR Arch User Repository — usage and security
ArchWiki — paru Complete reference for paru
Arch News Required manual interventions — read before each update

Local help pages

Help
$ pacman --help
$ man pacman
$ man pacman.conf
$ man makepkg
$ paru --help

📖 Recommended Reading from SafeITExperts

Source Content
APT Debian Complete APT / Debian guide 2026
Zypper openSUSE Complete Zypper / openSUSE guide 2026
DNF Fedora Complete DNF / Fedora guide 2026
sudo ou su ? Linux privilege escalation

🎯 Conclusion

Pacman is a remarkably simple, fast, and consistent package manager, perfectly suited to Arch Linux's rolling release model. Mastering it requires understanding repositories, the priority order in pacman.conf , and a few essential reflexes.

Key takeaways
  • Always pacman -Syu (never -Sy alone)
  • Use paru for AUR — safer, better maintained
  • Prefer paccache -rk2 over pacman -Scc
  • Read Arch News before each update after absence
  • Handle .pacnew files with pacdiff after updates
  • Pacman 7.1.0 brings enhanced sandbox — check man pacman.conf if using older config
Pour être informé des derniers articles, inscrivez vous :
Commenter cet article

Archives

Articles récents