In software, a package management system, also called package manager, is a collection of software tools to automate the process of installing, upgrading, configuring, and removing software packages for a computer's operating system in a consistent manner. It typically maintains a database of software dependencies and version information to prevent software mismatches and missing prerequisites.
Packages are distributions of software, applications and data. Packages also contain metadata, such as the software's name, description of its purpose, version number, vendor, checksum, and a list of dependencies necessary for the software to run properly. Upon installation, metadata is stored in a local package database.
Package management systems are designed to save organizations time and money through remote administration and software distribution technology that eliminate the need for manual installs and updates. This can be particularly useful for large enterprises whose operating systems are based on Linux and other Unix-like systems, typically consisting of hundreds or even thousands of distinct software packages; in the former case, a package management system is a convenience, in the latter case it becomes essential.[1]
Synaptic, a popular graphical frontend for package management in
Linux Debian derived distros
Impact
Ian Murdock has commented that package management is "the single biggest advancement Linux has brought to the industry", that it blurs the boundaries between operating system and applications, and that it makes it "easier to push new innovations [...] into the marketplace and [...] evolve the OS".[2]
Terminology
A package management system is often called an "install manager". This can lead to confusion between a package management system and an installer. The differences include:
| Package management system | Installer |
|---|
| Usually part of an operating system. | Each product comes bundled with its own installer. |
| Uses one installation database. | Performs its own installation, sometimes recording information about that installation in a registry. |
| Can verify and manage all packages on the system. | Works only with its bundled product. |
| One package management system vendor. | Multiple installer vendors. |
| One package format. | Multiple installation formats. |
A package, for package managers, denotes a specific set of files bundled with the appropriate metadata for use by a package manager. This can be confusing, as some programming languages often use the word "package" as a specific form of software library. Furthermore, that software library can be distributed in a package of files bundled for a package manager.
Functions
Illustration of a package management system being used to
download new software. Manual actions can include accepting a license agreement or selecting some package-specific configuration options.
Package management systems are charged with the task of organizing all of the packages installed on a system. Typical functions of a package management system include:
- Verifying file checksums to ensure correct and complete packages;
- Verifying digital signatures to authenticate the origin of packages;
- Applying file archivers to manage encapsulated files;
- Upgrading software with latest versions, typically from a software repository;
- Grouping of packages by function to reduce user confusion;
- Managing dependencies to ensure a package is installed with all packages it requires. This resolved the problem known as Dependency Hell.
Some additional challenges are met by only a few package management systems.
Challenges with shared libraries
Computer systems which rely on dynamic library linking, instead of static library linking, share executable libraries of machine instructions across packages and applications. In these systems, complex relationships between different packages requiring different versions of libraries results in a challenge colloquially known as "dependency hell". On Microsoft Windows systems, this is also called "DLL hell" when working with dynamically linked libraries. Good package management is vital on these systems.[3]
Front-ends for locally compiled packages
System administrators may install and maintain software using tools other than package management software. For example, a local administrator may download unpackaged source code, compile it, and install it. This may cause the state of the local system to fall out of synchronization with the state of the package manager's database. The local administrator will be required to take additional measures, such as manually managing some dependencies or integrating the changes into the package manager.
There are tools available to ensure that locally compiled packages are integrated with the package management. For distributions based on .deb and .rpm files as well as Slackware Linux, there is CheckInstall, and for recipe-based systems such as Gentoo Linux and hybrid systems such as Arch Linux, it is possible to write a recipe first, which then ensures that the package fits into the local package database.[citation needed]
Maintenance of configuration
Particularly troublesome with software upgrades are upgrades of configuration files. Since package management systems, at least on Unix systems, originated as extensions of file archiving utilities, they can usually only either overwrite or retain configuration files, rather than applying rules to them. There are exceptions to this that usually apply to kernel configuration (which, if broken, will render the computer unusable after a restart). Problems can be caused if the format of configuration files changes. For instance, if the old configuration file does not explicitly disable new options that should be disabled. Some package management systems, such as Debian's dpkg, allow configuration during installation. In other situations, it is desirable to install packages with the default configuration and then overwrite this configuration, for instance, in headless installations to a large number of computers. (This kind of pre-configured installation is also supported by dpkg.)
Repositories
To give users more control over the kinds of software that they are allowing to be installed on their system (and sometimes due to legal or convenience reasons on the distributors' side), software is often downloaded from a number of software repositories.[4]
Upgrade suppression
When a user interacts with the package management software to bring about an upgrade, it is customary to present the user with the list of things to be done (usually the list of packages to be upgraded, and possibly giving the old and new version numbers), and allow the user to either accept the upgrade in bulk, or select individual packages for upgrades. Many package management systems can be configured to never upgrade certain packages, or to upgrade them only when critical vulnerabilities or instabilities are found in the previous version, as defined by the packager of the software. This process is sometimes called version pinning.
For instance:
- yum supports this with the syntax exclude=openoffice*,[5]
- pacman with IgnorePkg = openoffice[6] (to suppress upgrading openoffice in both cases)
- dpkg and dselect support this partially through the hold flag in package selections
- APT extends the hold flag through the complex "pinning" mechanism[7]
- Users can also blacklist a package[8]
- aptitude has "hold" and "forbid" flags
- portage supports this through the package.mask configuration file
- DotPet from .PET packages in Puppy Linux, but is efficient in console and lightweight
Cascading package removal
Some of the more advanced package management features offer "cascading package removal",[6] in which all packages that depend on the target package and all packages that only the target package depends on, are also removed.
Common package management systems and formats
Package formats
Main articles:
Linux package formats and file archive
Each package manager relies on the format and metadata of the packages it can manage. That is, package managers need groups of files to be bundled for the specific package manager along with appropriate metadata, such as dependencies. Often, a core set of utilities manages the basic installation from these packages and multiple package managers use these utilities to provide additional functionality.
For example, yum relies on rpm as a backend. Yum extends the functionality of the backend by adding features such as simple configuration for maintaining a network of systems. As another example, the Synaptic Package Manager provides a graphical user interface by using the Advanced Packaging Tool (apt) library, which, in turn, relies on dpkg for core functionality.
Alien is a program that converts between different Linux package formats. It supports conversion between Linux Standard Base conform RPM, deb, Stampede (.slp) and Slackware (tgz and txz) packages.
Free and open source software systems
By the nature of free and open source software, packages under similar and compatible licenses are available for use on a number of operating systems. These packages can be combined and distributed using configurable and internally complex packaging systems to handle many permutations of software and manage version-specific dependencies and conflicts. Some packaging systems of free and open source software are also themselves released as free and open source software. One typical difference between package management in proprietary operating systems, such as Mac OS X and Windows, and those in free and open source software, such as Linux, is that free and open source software systems permit third-party packages to also be installed and upgraded through the same mechanism, whereas the package management systems of Mac OS X and Windows will only upgrade software provided by Apple and Microsoft, respectively (with the exception of some third party drivers in Windows). The ability to continuously upgrade third party software is typically added by adding the URL of the corresponding repository to the package management's configuration file.
Application-level package managers
Main article: Application-level package managers
Besides the systems-level application managers, there are some add-on package managers for operating systems with limited capabilities and for programming languages where developers need the latest libraries.
In contrast to systems-level application managers, application-level package managers focus on a small part of the software system. They typically reside within a directory tree that is not maintained by the systems-level package manager (like c:\cygwin or /usr/local/fink). However, this is not the case for the package managers that deal with programming libraries. This leads to a conflict as both package managers claim to "own" a file and might break upgrades.
See also
References
External links
