Blazing Performance
Zero Subprocess Strategy: Direct libalpm integration for system packages and pure Rust runtime managers. No more waiting for shell scripts to initialize.
Pure Rust Storage: Embedded redb database for package metadata and completion caching. Queries are consistently < 1 ms.
Shared Client Pooling: Reused network connections for lightning-fast API lookups and downloads.
Pure Rust Archives: Native tar/zip/xz/zstd handling with no C dependencies.
🛠? Unified Runtime Management
One command to rule them all. No more .nvmrc vs .tool-versions confusion.
Native Support: Node.js, Bun, Python, Go, Rust, Ruby, and Java with pure Rust implementations.
Built-in Mise: 100+ additional runtimes (Deno, Elixir, Zig, Erlang, Swift, etc.) via bundled mise - no separate installation required!
Auto-Detection: OMG detects required versions by climbing the directory tree for config files (.nvmrc, .bun-version, .tool-versions, .mise.toml, .mise.local.toml, rust-toolchain.toml).
Seamless Fallback: When a runtime isn't natively supported, OMG automatically downloads and uses mise - zero user intervention needed.
Node + NVM: Prefers OMG-managed Node installs, but transparently falls back to local NVM versions when present.
Rust Toolchains: Native Rust downloads with rust-toolchain.toml support (components, targets, profiles).
List Available: omg list node --available shows real-time versions from official upstream APIs.
🛡? Enterprise-Grade Security (2026 Standard)
OMG doesn't just install; it audits, verifies, and protects.
SLSA & PGP: Built-in verification for build provenance and signatures using Sequoia-OpenPGP (PQC-ready).
Sigstore/Rekor Integration: Binary transparency via the Sigstore public good infrastructure.
Security Grading: Every package is assigned a grade from LOCKED (Verified SLSA) to RISK (Known Vulnerabilities).
SBOM Generation: CycloneDX 1.5 compliant Software Bill of Materials for FDA, FedRAMP, and SOC2 compliance.
Secret Scanning: Detect leaked credentials (AWS keys, GitHub tokens, private keys) before they're committed.
Tamper-Proof Audit Logs: Hash-chained audit entries with integrity verification for compliance.
Policy Enforcement: Define a global policy (policy.toml) to block packages that don't meet your team's security standards.
