Source resolution

Fur resolves install targets across five backends. Each backend has its own capabilities, failure modes, and trust posture.

SourcesWatch: How fur picks a backend

Backend matrix

Nixpkgs — nix profile for user scope; system scope only via explicit --system and the managed module path.
AppImage — copy into ~/.local/apps, set executable, emit a desktop file, run via appimage-run when present.
Debian (.deb) — extract with dpkg-deb -x, dependency hints from data/deb-deps.toml; autoPatchelf first, fall back to a steam-run wrapper.
Flatpak — full command plane with remote management and typed errors.
Foxora Kits — signed catalogs with trust + pin policy and immutable provenance attestations.

If --from is given, only that backend is tried.
Otherwise: nixpkgs → kits → flatpak → deb (when path-like) → appimage (when path-like).
The first backend that resolves the target wins; the rest are skipped.

The resolved backend is reported in the JSON envelope:

bash

fur install hello --json | jq -e '.schema == "fur.v1" and .action == "install" and .source == "nixpkgs"'

Signed catalogs with trust + pin policy and immutable provenance.