OMG

Blazing Performance Zero Subprocess Strategy: Direct libalpm integration for system packages and pure Rust runtime managers. No more waiting for shell scripts to initialize. Pure Rust Storage: Embedded redb database for package metadata and completion caching. Queries are consistently < 1 ms. Shared Client Pooling: Reused network connections for lightning-fast API lookups and downloads. Pure Rust Archives: Native tar/zip/xz/zstd handling with no C dependencies. 🛠? Unified Runtime Management One command to rule them all. No more .nvmrc vs .tool-versions confusion.

Native Support: Node.js, Bun, Python, Go, Rust, Ruby, and Java with pure Rust implementations. Built-in Mise: 100+ additional runtimes (Deno, Elixir, Zig, Erlang, Swift, etc.) via bundled mise - no separate installation required! Auto-Detection: OMG detects required versions by climbing the directory tree for config files (.nvmrc, .bun-version, .tool-versions, .mise.toml, .mise.local.toml, rust-toolchain.toml). Seamless Fallback: When a runtime isn't natively supported, OMG automatically downloads and uses mise - zero user intervention needed. Node + NVM: Prefers OMG-managed Node installs, but transparently falls back to local NVM versions when present. Rust Toolchains: Native Rust downloads with rust-toolchain.toml support (components, targets, profiles). List Available: omg list node --available shows real-time versions from official upstream APIs. 🛡? Enterprise-Grade Security (2026 Standard) OMG doesn't just install; it audits, verifies, and protects.

SLSA & PGP: Built-in verification for build provenance and signatures using Sequoia-OpenPGP (PQC-ready). Sigstore/Rekor Integration: Binary transparency via the Sigstore public good infrastructure. Security Grading: Every package is assigned a grade from LOCKED (Verified SLSA) to RISK (Known Vulnerabilities). SBOM Generation: CycloneDX 1.5 compliant Software Bill of Materials for FDA, FedRAMP, and SOC2 compliance. Secret Scanning: Detect leaked credentials (AWS keys, GitHub tokens, private keys) before they're committed. Tamper-Proof Audit Logs: Hash-chained audit entries with integrity verification for compliance. Policy Enforcement: Define a global policy (policy.toml) to block packages that don't meet your team's security standards.