nog

nog is a Rust-based package manager wrapper for Arch Linux that adds a tiered hold system on top of pacman. Rather than replacing pacman, it uses the same commands and flags while introducing update delays based on package importance. **Tier system:** Packages are classified into three tiers with configurable hold durations: - Tier 1 (kernel, bootloader, glibc, systemd, mesa): 30-day hold - Tier 2 (desktop environments, key applications): 15-day hold - Tier 3 (everything else): 7-day hold Holds count from when an update was first seen, not the newest build, preventing busy packages from being held indefinitely. Once a hold expires, the newest version must also pass a shorter "safety wait" (7/3/1 days by tier) before installation. **Multi-source support:** nog manages updates from official pacman repositories, AUR (via yay or paru), Flatpak, and Snap. Each source can be activated or deactivated individually. Snap holds are placed in snapd itself to prevent auto-refresh bypass. **Security features:** Keyring packages are never held. Kill switches can cut off AUR or chaotic-aur sources during incidents. nog runs as the normal user and escalates to root only at specific moments. Holds use pacman's own --ignore flag. AUR helpers receive only cleared package names, preventing bypass through failed lookups. **Reporting:** Updates are grouped into Ready, Held, and Unknown categories with tier colors. A summary table shows per-repository status. Each run is logged to a dated CSV file kept for 90 days. Reboot advice is provided when kernel or driver updates leave the running system out of sync. **Maintenance:** nog clean clears old downloads from pacman's cache with tier-aware retention (3 versions for Tier 1, 2 for Tier 2, 1 for Tier 3), always keeping installed versions for rollback. **Configuration:** Tier assignments and hold durations are configured in /etc/nog/. Packages can be pinned to tiers, grouped to move together (e.g., kernel and headers), and Tier 1 can require manual sign-off in expert mode.