LuaRocks

LuaRocks is a package manager and module-publishing service built around Lua’s rock and rockspec formats. It is a strong fit for Lua developers who need dependency resolution across Lua versions; teams that require package-signing assurances should look elsewhere.

Overview

The CLI uses manifests to find packages, choose a version and platform match, and install the corresponding rock or rockspec locally. Rocks are zip files containing a rockspec and the files needed to install a module. Their version dependency information lets LuaRocks install dependencies and load the appropriate module version, making it useful for managing Lua projects without extending that convenience to unrelated ecosystems.

Users can draw on the root manifest, per-user manifests, or custom manifests to organize module collections. Custom manifests may accept contributions or be limited to their administrators. Development versions live in a separate manifest and are not installed by default, a sensible boundary for developers who want to avoid unintentionally selecting work in progress. Offline installation is supported, though that does not remove the need to obtain packages before going offline.

Key features

Version-aware package management

LuaRocks.org provides manifests for all Lua versions and separate compatibility manifests for Lua 5.1, 5.2, 5.3, and 5.4. This is valuable for projects that must target older or multiple Lua releases: developers can select a compatibility manifest rather than relying on one undifferentiated package collection. The tool’s scope remains Lua modules, not general-purpose package management.

Publishing and fallback sources

Anyone can register and publish a Lua module by uploading a rockspec, then add rock files for a particular version. The current release supports the luarocks upload command, which uses LuaRocks.org’s HTTP API. An HTTP mirror and daily GitHub backups of stable and development manifest data offer fallback package servers; they are useful resilience options, not a substitute for package-signing safeguards.

Implementation and security

LuaRocks is described as a pure Lua application with no library dependencies, although the current release uses helper tools. That keeps its implementation centered on Lua, but does not mean setup is entirely free of external tooling. A 2019 security incident page says packages on LuaRocks.org did not have signing and verification at that time. Teams with strict supply-chain assurance requirements should account for that history and seek stronger guarantees before depending on hosted packages.

Pricing

LuaRocks is free, with a free plan at no cost. It includes the package manager and module-hosting service, with no paid tier or trial to weigh against it. That makes it accessible to individual developers and projects of any budget, but the free price should not be mistaken for security certification or package verification.

Platforms

LuaRocks lists API, Linux, macOS, self-hosted, and Windows support. Installation instructions cover Unix systems including Linux and BSDs, macOS, and Windows; supported platforms also include Unix, FreeBSD, and Cygwin. That breadth helps teams working across common desktop and server environments, though compatibility still depends on the package and target platform match.

Who it's for

LuaRocks suits Lua developers who want manifest-based discovery, dependency handling, offline installation, or a place to publish modules. Per-user and custom manifests are also useful when a project needs its own organized collection rather than relying only on the root manifest. It is a less compelling choice for organizations that need package signing and verification as a firm requirement, or for developers seeking a package manager beyond the Lua ecosystem.

Pros and cons

• Pro: Dependency information in rocks supports automatic dependency installation and loading the appropriate module version, reducing manual version coordination.
• Pro: Separate manifests for Lua 5.1 through 5.4 help developers choose packages aligned with the Lua release they target.
• Pro: Offline installation and mirror or GitHub manifest backups provide options when the primary package server is unavailable or network access is limited.
• Pro: Free publishing lets module authors register, upload rockspecs, and distribute versioned rock files without a paid plan.
• Con: The 2019 incident page reported no package signing or verification at the time, a material concern for teams with strict supply-chain controls.
• Con: Its Lua-specific package formats and manifests make it a poor fit for managing packages in other language ecosystems.
• Con: The current release uses helper tools despite being a pure Lua application with no library dependencies, so deployment is not necessarily tool-free.

Alternatives

For other package registries and package managers, see Package Registries and Package Managers. Choose Bioconductor instead for free open-source software with no paid plans or usage limits stated; CPAN instead for free Perl software and documentation; or Inedo ProGet when private-package and Docker feeds matter, accepting limited security and compliance features in its free edition. npm is an alternative for public package authors who want unlimited public packages and registry access on its free plan. Consider pypiserver for a self-hosted, minimal PyPI-compatible API, or R-universe for public publishing through a registry tied to a GitHub account. aptly is a free CLI tool with an HTTP REST service, while CocoaPods is another free option with no paid plans listed.

Verdict

LuaRocks is the right choice for Lua developers who want free module installation, dependency handling, and publishing organized around Lua-specific manifests. Its compatibility manifests and offline support are practical advantages; its central reason to look elsewhere is the lack of established package-signing assurances described in the 2019 incident account.