Credential access
Reads environment variables, server credentials, and local package config.
brew / rank 847
Package manager for the Lua programming language. Version 3.13.0 via Homebrew; verified from local package data.
agent safety
luarocks manages Lua packages and can install or publish project dependencies.
Reads environment variables, server credentials, and local package config.
Can install packages and interact with package servers.
Can publish Lua rocks and generated package artifacts.
Gate upload, install scripts, and credentialed server operations.
Allow dependency queries; require approval for package publication and secret-backed actions.
install
brew install luarocksprovider-native install command
overview
Package manager for the Lua programming language
history
LuaRocks is the package manager and public package repository system for Lua modules. It introduced the rockspec-centered workflow that lets Lua packages declare metadata, dependencies, sources, and build rules in Lua.
The LuaRocks project describes itself as the package manager for the Lua programming language. Its repository README and wiki say it installs modules as self-contained packages called rocks and supports local and remote repositories plus multiple local rocks trees.
LuaRocks' documentation centers on the rockspec: a Lua metadata file that tells the tool how to fetch, build, and install a package. This design made LuaRocks both a package installer and a lightweight build/publishing convention for Lua modules, including modules with native C extensions.
LuaRocks became the default package-distribution culture for much of Lua outside application-specific ecosystems. The official site surfaces recent modules, labels, weekly download counts, root manifests, custom manifests, mirrors, and upload flows, showing that LuaRocks is both a CLI and the central package index.
The input metadata shows broad OS package coverage: LuaRocks is available through Homebrew, MacPorts, Debian, Ubuntu, Fedora, Alpine, Arch, Nix, Scoop, and Chocolatey. That matters because Lua projects often need LuaRocks before they can install testing tools, web frameworks, OpenResty libraries, or native-binding modules.
The command-line interface is luarocks. It supports installing, building, packing, uploading, searching, showing, removing, testing, and configuring rocks, and can operate against selected servers, trees, and dependency modes.
Package authors write a rockspec, tag or publish their source, and submit or upload the rockspec. LuaRocks can build from source, make from a local checkout, pack source or binary rocks, and publish artifacts that users install without needing the original source-control tool.
LuaRocks is central package-nerd infrastructure for Lua because it defines the names, versions, build metadata, binary/source artifact formats, and repository manifests that other tools consume. It is the closest analogue to npm, RubyGems, or CPAN for Lua, but with Lua-specific details such as Lua-version-specific trees and native module paths.
It is also historically important because it works across stock Lua and LuaJIT ecosystems. That cross-runtime support, plus package-manager availability on Unix and Windows, made it the practical bootstrap path for Lua dependency management.
security posture
generalized runtime or code generation signal. infrastructure mutation or orchestration signal.
orange risk · medium confidence · infrastructure
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Config paths the tool may read or write during local use.
$XDG_CONFIG_HOME/luarocks/upload_config.lua~/.config/luarocks/upload_config.lua~/.luarocks/upload_config.luaCredential-bearing paths to review before unattended agent runs.
$XDG_CONFIG_HOME/luarocks/upload_config.lua~/.config/luarocks/upload_config.lua~/.luarocks/upload_config.luaexecutables
| Command | Kind | Exposure | Note |
|---|---|---|---|
luarocks | executable | indexed executable | Discovered from the local executable index. |
luarocks-admin | executable | indexed executable | Discovered from the local executable index. |
freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
install metadata
| Package key | brew:luarocks |
|---|---|
| Version | 3.13.0 |
| Package manager | Homebrew |
| Homepage | https://luarocks.org/ |
| Repository | https://github.com/luarocks/luarocks |
| Bottle | not recorded |
| Service | none declared |
source trail
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
View the package source record on GitHub.