Repository navigation
🚀 Release v1.3.0
This release adds support for 1 new application (Speedtest CLI), bringing the total number of supported packages to 17. It also introduces optional GitHub API token support with rate-limit diagnostics, user-level bash completion, improved self-update and APT update messaging, a dedicated Proton VPN reinstall routine, additional cleanup during Yubico removal, and Bambu Studio runtime hardening.
📦 New Packages & Management
Speedtest CLI: Installed from the official Ookla packagecloud APT repository. MPM downloads the repository setup script from https://packagecloud.io/install/repositories/ookla/speedtest-cli/script.deb.sh, syntax-checks it with bash -n, and runs it with forced os=ubuntu and dist=jammy variables because the official repository does not currently provide newer distribution revisions. After repository configuration, MPM installs the speedtest package via APT. Updates are handled through APT.
Speedtest CLI removal: Removal purges the speedtest package and deletes known repository/keyring files created by the packagecloud installer. It also removes the MPM state file for the package.
Aliases: Added new package entries/aliases: speedtest, speedtest-cli, and ookla.
🔐 Security & Verification
GitHub API token support: Added optional GITHUB_TOKEN support in mpm.conf and optional MPM_GITHUB_TOKEN environment variable support. If a token is present, MPM adds an Authorization: Bearer header to GitHub API requests. This can raise the GitHub API rate limit from 60 requests/h per IP to 5000 requests/h per token, depending on GitHub limits.
GitHub token permission warning: If mpm.conf contains a GitHub token and is readable by group/others, MPM warns about insecure permissions and recommends chmod 600 mpm.conf.
GitHub rate-limit diagnostics: When a GitHub API request fails, MPM now checks https://api.github.com/rate_limit and reports whether the API rate limit is confirmed or suspected. It also displays hints about using a token, possible token exhaustion, or waiting for the limit reset.
Self-update download feedback: MPM now displays an informational message when downloading the SHA256 checksum file (SHA256SUMS) during self-update, improving transparency of the verification process.
Existing verification behavior remains unchanged: Self-update still requires and verifies SHA256SUMS. Yubico external script download still verifies SHA256 when downloaded automatically. Proton packages still use their official SHA512/SHA256 verification methods.
🛠️ Improvements & Fixes
GitHub API handling: All GitHub API requests are now centralized through a github_fetch helper. This affects self-update checks, Yubico script release checks, Darktable, TigerTag, GoVerlay, and Bambu Studio release checks.
Self-update UX: --update-self now displays an installed/latest version table before proceeding with the update.
Self-update Yubico script message: If the Yubico script did not exist before self-update, MPM now reports that it was installed together with the main script update instead of reporting that it was updated.
Backup messages: Before creating a backup in old/, MPM now explains that it is creating a backup of the previous file version and shows where it will be saved.
APT update UX: For APT-managed packages, --update now shows the installed version and APT candidate version before attempting the upgrade. After a successful upgrade, MPM logs the updated version.
Proton VPN: Added a dedicated --reinstall proton-vpn routine. It purges the main Proton VPN package with autoremove --purge, runs autoremove, then reinstalls the application from the Proton VPN repository. If the repository package is already present, it is not downloaded again.
Yubico removal: Removing Yubico Authenticator now also removes the local install-yubico-authenticator.sh helper script if it exists. If the script is needed again later, MPM can download it again from the appropriate MPM release assets.
Bambu Studio: MPM now ensures ca-certificates is installed before Bambu Studio installation. It also detects a missing user locale and attempts to generate it. The generated .desktop entry now starts Bambu Studio with SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt to improve TLS certificate handling.
Desktop entries: Darktable now includes StartupWMClass=org.darktable.darktable. TigerTag now includes StartupWMClass=tigertag-inventory. These entries improve window grouping/taskbar behavior.
Icon downloads: MPM now prints an informational message when downloading application icons for .desktop entries.
Unknown command hint: Unknown commands now show a hint to run --help to see available commands.
Hidden-directory suggestion: The suggestion to migrate the script to ~/.mpm/ is now displayed as a clearer housekeeping block.
Bambu Studio Ubuntu detection: The Ubuntu version detection for choosing the correct Bambu Studio AppImage build now uses numeric major-version comparison instead of hardcoded version strings. This ensures correct behavior on future Ubuntu releases (27.04, 28.04, etc.) without requiring script updates.
Log level behavior: [OK] messages are now always displayed regardless of the configured LOG_LEVEL, consistent with [ERROR] messages. Previously, setting LOG_LEVEL=warn or LOG_LEVEL=error would hide success confirmations, which could be confusing.
Internal optimizations: Reduced redundant filesystem checks during logging (config directory is now verified once per session instead of on every log message). Removed a redundant duplicate call to language detection during script startup.
Download reliability: Proton Authenticator and Proton Pass downloads (both .deb files and version.json files) now include --retry 3 and --connect-timeout 10 flags, improving resilience against transient network failures. This applies to install, update, check, and reinstall operations.
DEB installation verification: The install_deb_file function now extracts the package name from the .deb file before installation and verifies after installation that the package was actually registered by dpkg. If the package is not found after installation, an explicit error is reported. This affects Steam, Dropbox, Google Chrome, VS Code, and GoVerlay installations.
Darktable download cleanup: If the Darktable AppImage download fails, MPM now removes the potentially incomplete file from the installation directory before reporting the error.
Self-update force hint: The SELF_FORCE_HINT message now includes the actual script filename and provides a more descriptive explanation of when to use MPM_FORCE_UPDATE=1.
Checksum download feedback: MPM now displays an informational message when downloading the SHA256SUMS file during self-update and Yubico script download operations.
Internal rename: Renamed extract_appimage_version to extract_version_from_string to better reflect its general-purpose usage across multiple package handlers.
Steam architecture check: Minor code style improvement in Steam installation — the i386 architecture check now uses an explicit if statement instead of a short-circuit || construct for better readability and set -e compatibility.
🖥️ CLI & UI
Bash completion: Added user-level bash completion installed to ~/.local/share/bash-completion/completions/Multi_Package_Manager.sh. Completion is installed during --migrate-to-hidden and refreshed automatically if an already installed completion file belongs to an older MPM version. It completes MPM commands, package names, and --lang values (auto, pl, en).
Configuration: Added support for GITHUB_TOKEN in mpm.conf. The environment variable MPM_GITHUB_TOKEN overrides the value from mpm.conf.
Help/banner: Updated --help, startup banners, and package lists to reflect 17 supported packages and include Speedtest CLI. Tailscale is described as a CLI package in help output.
State/config documentation: Updated documentation to reflect new Speedtest state file usage and the optional GitHub token configuration.
⚠️ Important Notes & Limitations
Speedtest CLI: The Ookla repository script is executed with forced os=ubuntu and dist=jammy variables on systems where the official repository does not provide a matching distribution revision. This is intentional but may need adjustment if Ookla changes the repository layout in the future.
Speedtest CLI removal: MPM removes known repository files and keyrings created by the packagecloud installer. If the installer used non-standard paths, leftover files may remain.
GitHub token: The token is optional. Without a token, GitHub API usage is limited to 60 requests/h per IP. With a token, the limit is 5000 requests/h, but tokens must be kept private. Do not commit mpm.conf containing a token to public repositories.
Bash completion: Completion requires the bash-completion package and a shell session that loads user completions. If completion does not work immediately, restart the terminal or source ~/.bashrc.
Yubico removal: Because removal now deletes the local Yubico installer script, a future Yubico installation may require downloading the script again from the MPM release assets.
Bambu Studio: Locale generation and ca-certificates installation are best-effort. If the system does not provide locale-gen, MPM only shows a hint. The .desktop entry uses a fixed SSL_CERT_FILE path pointing to the standard Debian/Ubuntu CA bundle.
📋 Full List of Supported Packages (17)
discord, proton-authenticator, proton-pass, yubico, spotify, steam, dropbox, google-chrome, proton-vpn, brave, vscode, darktable, tigertag, tailscale, goverlay, bambu-studio, speedtest.
If you encounter any bugs, please report them in the Issues tab.
If you like this project, leave a star on GitHub! ⭐