LuaRocks

LuaRocks is a free package manager and module host built specifically for Lua. It suits developers who want a shared way to install dependencies or publish Lua modules; teams requiring package-signing assurances should look elsewhere.

Overview

LuaRocks uses manifests to find modules, choose a version and platform match, and install the corresponding package locally. A rock is a zip archive containing its rockspec and the files needed to install a module. Version information in rocks lets LuaRocks install dependencies and load the intended module version, which helps keep a project’s dependency choices organized.

Users can draw from the root manifest, per-user manifests, or custom manifests. A custom collection can accept contributions or be limited to its administrators, making this useful for teams that want to manage a focused module collection. Development releases live in a separate manifest and are not installed by default. Offline installation is supported, which helps when packages have already been obtained and a machine cannot reach a package server.

Key features

Lua version and platform coverage

LuaRocks.org provides manifests for modules across Lua versions and separate compatibility manifests for Lua 5.1, 5.2, 5.3, and 5.4. That gives developers a way to choose packages with a specific Lua version in mind. Supported platforms include Linux, macOS, Windows, Unix, FreeBSD, and Cygwin, while installation guidance covers Unix systems including Linux and BSD, macOS, and Windows.

Publishing and fallback servers

Anyone can register and publish a module by uploading a rockspec, then add rock files for a particular version. The current release supports publishing to LuaRocks.org with the luarocks upload command. An HTTP mirror and daily GitHub backups of stable and development manifest data offer fallback package servers if the primary route is unavailable.

LuaRocks is a pure Lua application without library dependencies, although its current release uses helper tools. The 2019 security incident page says packages did not have signing and verification at that time, a significant concern for organizations that require signed packages. The official site links to its GitHub issue tracker for reporting problems.

Pricing

LuaRocks is free: the LuaRocks plan costs nothing and includes the package manager and module hosting service. There is no free trial because the service is already free, and no paid tier or seat quota is stated. This makes it a straightforward fit for individual developers and teams that need Lua package management without a software fee; organizations that need package-signing assurances may need another workflow.

Platforms

LuaRocks supports Linux, macOS, Windows, Unix, FreeBSD, and Cygwin. Its package formats are .rock and .rockspec. Offline installation and dependency resolution are supported, so packages can be installed locally and their declared dependencies handled by the manager.

Who it's for

LuaRocks is the natural choice for Lua developers who need to discover modules, install dependencies, maintain custom manifests, or publish their own packages. It is also useful when projects target different Lua versions or need offline installation. It is a poorer fit for teams whose package workflow depends on signing and verification assurances.

Pros and cons

• Pros: Free package management and module hosting make it accessible for Lua projects without a software charge.
• Pros: Dependency resolution, offline installation, and version-specific manifests address common needs across Lua development workflows.
• Pros: Custom manifests and a separate development manifest allow teams to curate packages and keep development releases out of default installs.
• Cons: The package and manifest workflow is centered on Lua, so it is not a general-purpose registry for unrelated ecosystems.
• Cons: Packages were not signed or verified at the time of the 2019 security incident, which may rule it out for organizations with that requirement.

Alternatives

Choose npm for public package publishing and registry access in a JavaScript package workflow; its free plan is for public package authors and offers unlimited public packages. Inedo ProGet is a better candidate when private package feeds and Docker feeds matter, with a free edition that includes unlimited feeds but has limited security and compliance features. For a self-hosted package server with a minimal PyPI-compatible API, consider pypiserver.

Bioconductor is a free open-source software option for readers working in that ecosystem. CPAN is the free Perl software and documentation archive. R-universe offers free public package publishing and requires a GitHub account to publish a packages.json registry. aptly is a free CLI tool with an HTTP REST service for package repository management. CocoaPods is the free option for iOS and macOS projects.

Browse more options in Package Managers and Package Registries.

Verdict

LuaRocks is the right pick for Lua developers who want free module discovery, dependency handling, offline installation, and publishing in a Lua-focused workflow. Its manifest flexibility and Lua-version coverage are strong reasons to choose it. Look elsewhere if signed package verification is a requirement.