# Zp - source-based package manager

**URL:** <https://ziggit.dev/t/zp-source-based-package-manager/18082>\
**Category:** Showcase\
**Tags:** language, standard-library\
**Created:** [October 24, 2026, 4:40pm UTC](https://ziggit.dev/t/zp-source-based-package-manager/18082 "2026-10-24T16:40:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nevvixsz](https://ziggit.dev/letter_avatar_proxy/v4/letter/n/f475e1/32.png) [@nevvixsz](https://ziggit.dev/u/nevvixsz)\
**Post date:** [October 24, 2026, 4:40pm UTC](https://ziggit.dev/t/zp-source-based-package-manager/18082/1 "2026-10-24T16:40:14Z")

</div>

Hello Zig community,

A while ago I shared **zp** , a minimal source-based package manager written in Zig. Thanks to everyone who gave feedback last time. We’ve kept working on it and I’d like to share what has changed.

GitHub: [GitHub - understratum/zp: A minimal, source-based package manager · GitHub](https://github.com/understratum/zp)

## What is zp?

zp fetches package source tarballs, builds them and installs them on the system, with no prebuilt binaries. It’s inspired by CRUX/KISS Linux ports and Void’s `xbps-src`. It keeps a list of the files each package installed, so removal is clean.

The basic flow is:

```
zp sync # update the recipe repository
zp search htop
sudo zp add htop
sudo zp update # update all installed packages
sudo zp remove htop

```

Targeting Zig 0.17.

## What’s new

**Our own recipe repository.** Until now recipes had to come from somewhere else. We now have a dedicated repository, `zp-repo`, and we plan to add new packages to it very actively. Every package is a directory with:

- `<name>.zon`: metadata (name, version, license, source URL, dependencies)
- `BuildFile`: the shell script that builds and installs the package
- `update.json`: only for packages that are not hosted on GitHub, describing where to look for new versions

For example, `htop.zon` looks like this:

```
.{
    .name = "htop",
    .version = "3.5.3",
    .license = "GPL-2.0-or-later",
    .url = "https://github.com/htop-dev/htop/releases/download/3.5.3/htop-3.5.3.tar.xz",
    .hash = "abcdhash",
    .deps = .{ "ncurses" },
}

```

**New behavior.** If a package fails to build, zp now removes it, so a failed build doesn’t leave a half-installed package behind.

**Bug fixes and refactoring.** We fixed a handful of bugs and cleaned up parts of the code (parsing, file tracking, the build flow).

## What is NOT verified yet

Please keep in mind that this is still an early project. A lot of it is untested:

- most recipes in the repository have only been built on one machine (a CRUX-based system), so expect broken `BuildFile`s on other setups
- error paths (interrupted downloads, failing builds, partially installed packages) have had little testing
- there is no checksum verification of downloaded sources yet
- installing requires root, so please read a recipe before you run it: a `BuildFile` is an ordinary shell script and runs with your privileges

## How you can help

We’d be glad to get pull requests. Especially useful:

- new or fixed recipes for the repository
- testing on other distributions and reporting what breaks
- bug fixes, and review of the Zig code (the harsh feedback last time helped a lot!)
- ideas for the architecture and recipe format

Issues and pull requests are welcome. Thanks for reading, and any feedback is appreciated.

zp-repo: [GitHub - understratum/zp-repo: Repository · GitHub](https://github.com/understratum/zp-repo)

---

<div class="post-metadata">

**Author:** ![Sze](https://ziggit.dev/user_avatar/ziggit.dev/sze/32/496_2.png) [@Sze](https://ziggit.dev/u/Sze)\
**Post date:** [October 24, 2026, 5:14pm UTC](https://ziggit.dev/t/zp-source-based-package-manager/18082/2 "2026-10-24T17:14:43Z")

</div>

2 posts were merged into an existing topic: [Zp - A source-based package manager written in Zig](https://ziggit.dev/t/zp-a-source-based-package-manager-written-in-zig/17473)

---

<div class="post-metadata">

**Author:** ![Sze](https://ziggit.dev/user_avatar/ziggit.dev/sze/32/496_2.png) [@Sze](https://ziggit.dev/u/Sze)\
**Post date:** [October 24, 2026, 5:14pm UTC](https://ziggit.dev/t/zp-source-based-package-manager/18082/3 "2026-10-24T17:14:43Z")

</div>