Skip to content

New Advanced Packaging Tool (napt)

Jump to bottom
Zeon edited this page Sep 26, 2026 · 4 revisions

Warning from Arvor Wiki : This tool was developed for Arvor Linux and is no longer in use. Any information provided here is outdated.

napt (New Advanced Packaging Tool) was the default high-level package manager for Arvor Linux and Armvor Linux. Written in C++ and built upon the libapt library, it was designed to provide a simplified command syntax compared to its predecessor, apt-nf-tree and was replaced by Weld.

Unlike other system utilities that share a unified codebase across both distributions, napt implemented distinct operational behaviors depending on the target architecture, specifically tailoring its execution for arm64 environments.

Architecture and Repository Management

napt relies on a custom repository system configured via /etc/napt/sources.list and /etc/napt/sources.list.d/. It fetches custom repository metadata files (repo-metadata) to determine package availability, versions, and SHA256 checksums.

The package manager supports both standard APT repositories and local .deb files. When resolving dependencies, napt evaluates both the standard Debian archives and the custom Napt repositories, selecting the highest available version. Downloads are executed via curl and utilize multi-threading to fetch packages concurrently, strictly verifying SHA256 hashes before proceeding with an installation.

Transactional Safety Mechanism

To ensure system stability on mutable (non-immutable) systems, napt employs an advanced transactional update mechanism utilizing LVM (Logical Volume Manager) snapshots and chroot environments.

  1. Sandbox Creation: When a package installation, removal, or upgrade is initiated, napt creates an LVM snapshot of the root volume (named napt_sandbox_snap). The snapshot size is dynamically calculated based on the available free space in the volume group (ranging from 1GB to 5GB). It is then mounted at /nsm/napt/root.
  2. Chroot Verification: The transaction is executed entirely within this isolated chroot environment. System directories (/dev, /proc, /sys, etc.) are bind-mounted into the sandbox. If the transaction fails within the sandbox, the host system remains untouched.
  3. Host Commitment: If the transaction is verified as successful in the sandbox, napt prompts the user for confirmation (unless the --apply-host or -y flags are used). It then creates a pre-transaction snapshot (apt-pre) on the host system before applying the changes.
  4. Automatic Rollback: Upon successful application to the host, a post-transaction snapshot (apt-post) is created. If the host transaction fails, napt automatically rolls back the system to the apt-pre snapshot.
  5. Repository Synchronization: Operations that only involve syncing repository metadata (napt sync) bypass the snapshot testing mechanism entirely.

Security Features

napt implemented strict security protocols during its sandbox verification phase using Linux SECCOMP (Secure Computing Mode) and Berkeley Packet Filter (BPF).

Before executing a transaction inside the chroot, napt applies a SECCOMP filter that blocks dangerous system calls that could allow sandbox escape or kernel compromise. Blocked syscalls include reboot, init_module, kexec_load, swapon, ptrace, bpf, pivot_root, and settimeofday. If a process inside the sandbox attempts to execute one of these calls, the kernel denies it with an EPERM (Operation not permitted) error. This feature can be disabled by the user with the --no-seccomp flag.

User Interface

The CLI provides a modernized user experience compared to traditional APT frontends. It features:

  • Progress Bars: Real-time, colorized terminal progress bars with percentage indicators and Estimated Time of Arrival (ETA) calculations for both sandbox verification and host application phases.
  • Pagination: The search command supports pagination via the -p flag, allowing users to navigate large lists of search results.

Commands and Options

napt supports standard package management commands, including install, remove, purge, upgrade, dist-upgrade, search, sync, clean, and autoclean.

Notable command-line options include:

  • --apply-host: Skips the chroot sandbox verification and applies changes directly to the host system.
  • --no-seccomp: Disables the SECCOMP syscall filtering inside the chroot sandbox.
  • -y / --yes / --assume-yes: Automatically assumes "yes" to all prompts, bypassing the post-sandbox confirmation screen.

Clone this wiki locally