Pacman All packages are managed through pacman, a
package manager written specifically for Arch Linux. Pacman handles package installation, upgrades, downgrades, removal and features automatic dependency resolution. The packages for Arch Linux are obtained from the Arch Linux package tree and are compiled for the x86-64 architecture. Pacman typically uses binary packages with a .tar.zst extension (for
zstd compression), with .pkg placed before this to indicate that it is a Pacman package (giving .pkg.tar.zst); Packages can be installed via pacman -S , and pacman -Syu can be used to perform a full system upgrade. As well as Arch Linux, Pacman is also used for installing packages under
MSYS2 (a fork of
Cygwin) on Windows.
Repositories The following official binary repositories exist: •
core, which contains all the packages needed to set up a base system. Packages in this repository include kernel packages and shell languages. •
extra, which holds packages unneeded for the base system, including desktop environments and programs. •
multilib, a centralized repository for x86-64 users to more readily support
32-bit applications in a
64-bit environment. Packages in this repository include
Steam. Also,
testing repositories exist which include binary package candidates for other repositories. Currently, the following testing repositories exist: •
core-testing, with packages for
core. •
extra-testing, with packages for
extra. •
multilib-testing, with packages for
multilib. The
core-staging and
extra-staging repositories are used for some rebuilds to avoid broken packages in
testing. The developers recommend not using these repositories for any reason, stating that any system updating from them will "unquestionably break." There are also two other repositories that include the newest version of certain desktop environments. •
gnome-unstable, which contains packages of a new version of the software from
GNOME before being released into
testing. •
kde-unstable, which contains packages of a new version of
KDE software before being released into
testing. The
unstable repository was dropped in July 2008 and most of the packages moved to other repositories. The
community repository was merged with
extra in May 2023. In addition to the official repositories, there are a number of unofficial user repositories. The most well-known unofficial repository is the
Arch User Repository, or AUR, hosted on the Arch Linux site. The AUR does not host binary packages but instead a collection of build scripts known as
PKGBUILDs. PKGBUILD scripts are executed by the makepkg command, which downloads the necessary files from the software's repository and builds them using the Arch build system. The Arch Linux repositories contain both
libre and
nonfree software, and the default Arch Linux kernel contains
nonfree proprietary blobs, hence the distribution is not endorsed by the GNU project. The linux-libre kernel can be installed from the AUR or by enabling
Parabola's repositories.
Arch build system (ABS) The Arch build system (ABS) is a
ports-like source packaging system that compiles source tarballs into binary packages, which are installed via Pacman. The Arch build system provides a directory tree of
shell scripts, called
PKGBUILDs, that enable any and all official Arch packages to be customized and compiled. Rebuilding the entire system using modified
compiler flags is also supported by the Arch build system. The Arch build system makepkg tool can be used to create custom pkg.tar.zst packages from third-party sources. The resulting packages are also installable and trackable via Pacman.
Arch User Repository (AUR) In addition to the repositories, the Arch User Repository (AUR) provides user-made PKGBUILD scripts for packages not included within the main repositories. These PKGBUILD scripts simplify building from source by explicitly listing and checking for dependencies and configuring the install to match the Arch architecture. Arch User Repository helper programs, like Yay or Paru, can further streamline the downloading of PKGBUILD scripts and associated building processes. However, this comes at the cost of executing PKGBUILDs not validated by a trusted person; as a result, Arch developers have stated that the utilities for automatic finding, downloading and executing of PKGBUILDs will never be included in the official repositories. Instances of malware have been discovered in the past, such as on 19 July 2025 when a modified Firefox build was actually a
RAT, thus AUR packages should be installed with great care and Arch Linux directs users to avoid AUR helpers. Users can create packages compatible with Pacman using the Arch build system and custom PKGBUILD scripts. This functionality has helped support the Arch User Repository, which consists of user contributed packages to supplement the official repositories. The Arch User Repository provides the community with packages that are not included in the main repositories. Reasons for exclusion from the main repositories include: • Licensing issues: software that cannot be redistributed, but is free to use, can be included in the Arch User Repository since all that is hosted by the Arch Linux website is a shell script that downloads the actual software from elsewhere. Examples include proprietary
freeware such as
Google Earth and
Spotify. • Modified official packages: the Arch User Repository also contains many variations on the official packaging as well as beta versions of software that is contained within the repositories as stable releases. • Popularity of the software: rarely used programs have not been added to the official repositories (yet). • Betas or "nightly" versions of software which are very new and thus unstable. Examples include the "firefox-nightly" package, which gives new daily builds of the
Firefox web browser. PKGBUILDs for any software can be contributed by ordinary users. Any PKGBUILD that has 10 or more votes or more than 1% usage from pkgstats can be promoted into the
extra repository.
Reproducible builds Arch Linux is working on making all official packages
reproducible. This means that when a package is rebuilt in a different environment it should be bit-by-bit identical. This allows users and researchers to verify the integrity of the packages found in the official repository. The status of this effort can be monitored on the dedicated status page. == Derivatives and other products ==