Software repository: Difference between revisions

Revision as of 21:40, 15 January 2023

Revision as of 21:31, 16 January 2023

Line 1:

{{shortShort description|Storage ___location for software packages}}

{{See also|Repository (version control)}}

{{Cleanup list|date=March 2019}}

A '''software repository''', or '''repo''' for short, is a storage ___location for [[Package format|software packages]]. Often a table of contents is also stored, along with metadata. A software repository is typically managed by source or [[Version control|sourceversion control]], or repository managers. [[Package manager|Package managers]]s allow automatically installing and updating repositories, (sometimes called "packages").

== Overview ==

Many software publishers and other organizations maintain servers on the [[Internet]] for this purpose, either free of charge or for a subscription fee. Repositories may be solely for particular programs, such as [[CPAN]] for the [[Perl]] [[programming language]], or for an entire [[operating system]]. Operators of such repositories typically provide a [[package management system]], tools intended to search for, install and otherwise manipulate software packages from the repositories. For example, many [[Linux distribution]]s use [[APT (Debiansoftware)|Advanced Packaging Tool]] (APT), commonly found in [[Debian]] based distributions, or [[Yellowdog Updater, Modified| ([[Yum (software)yum]]) found in [[Red Hat]] based distributions. There are also multiple independent package management systems, such as pacman, used in [[Arch Linux]] and equo, found in [[Sabayon Linux]].

As software repositories are designed to include useful packages, major repositories are designed to be [[malware]] free. If a computer is configured to use a [[digitally signed]] repository from a reputable vendor, and is coupled with an appropriate [[File system permissions|permissions system]], this significantly reduces the threat of malware to these systems. As a side effect, many systems that have these capabilitiesabilities do not requireneed anti-malware software such as [[Antivirus software|anti-virusantivirus software]].<ref>[http://www.itmweb.com/essay503.htm itmWEB: Coping with Computer Viruses<!-- Bot generated title -->] {{webarchive |url=https://web.archive.org/web/20071014212824/http://www.itmweb.com/essay503.htm |date=October 14, 2007 }}</ref>

Most major [[Linux distribution]]s have many repositories around the world that mirror the main repository.

In an enterprise environment, a software repository is usually used to store artifacts, or to mirror external repositories which may be inaccessible due to security restrictions. Such repositories may provide additional functionality, like access control, versioning, security checks for uploaded software, cluster functionality etc. and typically support a variety of formats in one package, so as to cater for all the needs in an enterprise, and thus aiming to provide a single point of truth. Popular examples are JFrog Artifactory<ref>{{Cite web|url=https://www.wikieduonline.com/wiki/JFrog_Artifactory|title = JFrog Artifactory - wikieduonline}}</ref><ref>{{Cite web|url=https://jfrog.com/artifactory/|title=Artifactory - Universal Artifact Management}}</ref> and Nexus repository.<ref>{{Cite web|url=https://www.sonatype.com/products/repository-pro|title=Nexus Repository &#124; Software Component Management}}</ref>

At client side, a package manager helps installing from and updating the repositories.

Line 22:

A [[Package manager|package management system]] is different from a [[package development process]].

A typical use of a package management system is to facilitate the integration of code from possibly different sources into a coherent stand-alone operating unit. Thus, a package management system might be used to produce a [[Linux distribution|distribution of Linux]], possibly a distribution tailored to a specific restricted application.

A package development process, by contrast, is used to manage the co-development of code and documentation of a collection of functions or routines with a common theme, producing thereby a package of software functions that typically will not be complete and usable by themselves. A good package development process will help users conform to good documentation and coding practices, integrating some level of [[unit testing]].

Line 28:

== Selected repositories ==

The following table lists a few languages with repositories for contributed software. The "Autochecks" column describes the routine checks done.

Very few people have the ability to test their software under multiple operating systems with different versions of the core code and with other contributed packages they may use. For the [[R (programming language)|R programming language]], the [[CRAN (R programming language)|Comprehensive R Archive Network (CRAN)]] runs tests routinely.

To understand how this is valuable, imagine a situation with two developers, Sally and John. Sally contributes a package A. Sally only runs the current version of the software under one version of Microsoft Windows, and has only tested it in that environment. At more or less regular intervals, CRAN tests Sally's contribution under a dozen combinations of operating systems and versions of the core R language software. If one of them generates an error, she gets that error message. With luck, that error message details may provide enough input to allow enable a fix for the error, even if she cannot replicate it with her current hardware and software. Next, suppose John contributes to the repository a package B that uses a package A. Package B passes all the tests and is made available to users. Later, Sally submits an improved version of A, which unfortunately, breaks B. The autochecks make it possible to provide information to John so he can fix the problem.

This example exposes both a strength and a weakness in the R contributed-package system: CRAN supports this kind of [[automated testing]] of contributed packages, but packages contributed to CRAN need not specify the versions of other contributed packages that they use. Procedures for requesting specific versions of packages exist, but contributors might not use those procedures.

Beyond this, a repository such as CRAN running regular checks of contributed packages actually provides an extensive if ''ad hoc'' test suite for development versions of the core language. If Sally (in the example above) gets an error message she does not understand or thinks is inappropriate, especially from a development version of the language, she can (and often does with R) ask the core development-team for the language for help. In this way, the repository can contribute to improving the quality of the core language software.

{| class="wikitable"

|-

! Language[[Programming /language|Language]], purpose

! [[Package Developmentdevelopment Processprocess]]

! Repository

! Install methods

Line 112:

| [[R (programming language)|R]]

| R CMD check process<ref>{{cite news

| last = Leisch | first = Friedrich

| title = Creating R Packages: A Tutorial

| url =https://cran.r-project.org/doc/contrib/Leisch-CreatingPackages.pdf }}

</ref><ref>{{cite news

| last1 = Graves | first1 = Spencer B. | last2 = Dorai-Raj | first2=Sundar

| title = Creating R Packages, Using CRAN, R-Forge, And Local R Archive Networks And Subversion (SVN) Repositories

| url =https://cran.r-project.org/doc/contrib/Graves+DoraiRaj-RPackageDevelopment.pdf}}

</ref>

| CRAN<ref>{{Cite web|url=https://cran.r-project.org/|title=The Comprehensive R Archive Network|website=cran.r-project.org|access-date=2019-03-25}}</ref>

| install.packages<ref>{{Cite web|url=https://cran.r-project.org/doc/manuals/R-admin.html#Installing-packages|title=R Installation and Administration|website=cran.r-project.org|access-date=2019-03-25}}</ref><br />remotes<ref>{{cite book |last1=Wickham |first1=Hadley |last2=Bryan |first2=Jenny |title=R Packages |publisher=O'Reilly |chapter-url=https://r-pkgs.org/package-structure-state.html |chapter=Package structure and state}}</ref>

|[[GitHub]]<ref>{{cite journal |last1=Decan |first1=Alexandre |last2=Mens |first2=Tom |last3=Claes |first3=Maelick |last4=Grosjean |first4=Philippe |title=On the Development and Distribution of R Packages: An Empirical Analysis of the R Ecosystem |journal=Proceedings of the 2015 European Conference on Software Architecture Workshops - ECSAW '15 |date=2015 |pages=1–6 |doi=10.1145/2797433.2797476|s2cid=1680582 |url=https://zenodo.org/record/851546 }}</ref><br />

| FrequentlyOften on 12 platforms or combinations of different versions of R (devel, prerel, patched, release) on different operating systems (different versions of Linux, Windows, macOS, and Solaris).

|-

| [[Ruby (programming language)|Ruby]]

Line 129:

| RubyGems<ref name="rubygems">{{cite web |title=RubyGems.org your community gem host |url=https://rubygems.org |website=rubygems |access-date=2022-02-03}}

</ref>

| RubyGems,<ref name="rubygems" /> Bundler<ref>{{cite web |title=Bundler: The best way to manage a Ruby application's gems |url=https://bundler.io |website=bundler.io |access-date=2022-02-03}}</ref>

|

|

Line 149:

(Parts of this table were copied from a "List of Top Repositories by Programming Language" on [[Stack Overflow]]<ref>{{cite web|title=List of Top Repositories by Programming Language|url=https://stackoverflow.com/questions/1693529/list-of-top-repositories-by-programming-language|website=Stack Overflow|access-date=2010-04-14}}</ref>)

Many other programming languages, among them [[C (programming language)|C]], [[C++ (programming language)|C++]], and [[Fortran (programming language)|Fortran]], do not possess a central software repository with universal scope. Notable repositories with limited scope include:

* [[Netlib]], mainly mathematical routines for Fortran and C, historically one of the first open software repositories;

* [[Boost (C++ libraries)|Boost]], a strictly curated collection of high-quality libraries for C++; some code developed in Boost later became part of the C++ standard library.

Line 171:

|For managing Debian Packages<ref>{{Cite web|url=https://wiki.debian.org/Apt|title=Apt - Debian Wiki|website=wiki.debian.org|access-date=2019-11-22}}</ref>

|-

|[[Homebrew (package management softwaremanager)|Homebrew]]

|A package installer for MacOS that allows you to install packages Apple didn't<ref>{{Cite web|url=https://brew.sh/|title=Homebrew|website=Homebrew|language=en|access-date=2019-11-22}}</ref>

|-

|[[vcpkg]]

|A package manager for [[C (programming language)|C]] and [[C++]]<ref>{{Cite web|url=https://sdtimes.com/android/yelp-launches-yelp-fusion-microsoft-creates-vcpkg-tool-new-touch-sense-sdk-android-developers-sd-times-news-digest-sept-20-2016/|title=Yelp launches Yelp Fusion, Microsoft creates Vcpkg tool, and the new Touch Sense SDK for Android developers|date=September 20, 2016|website=SD Times}}</ref><ref>{{Cite web|url=https://sdtimes.com/msft/microsofts-c-library-manager-now-available-linux-mac-os/|title=Microsoft's C++ library manager now available for Linux and macOS|date=April 25, 2018|website=SD Times}}</ref>

|-

|[[Yum (software)|yum]] and [[DNF (software)|dnf]]

Line 196:

==== Artifacts and packages ====

Artifacts and packages inherently mean different things. Artifacts are simply an output or collection of files (ex. JAR, WAR, DLLS, RPM etc.) and one of those files may contain metadata (e.g. POM file). Whereas packages are a single archive file in a well-defined format (ex. [[NuGet]]) that contain files appropriate for the package type (ex. DLL, PDB).<ref name="sharedlibrary">{{Cite journal| last = Chris | first = Tucker | title = Optimal Package Install/Uninstall Manager | publisher = UC San Diego | date = 2007-03-15| page=1 | url = http://cseweb.ucsd.edu/~lerner/papers/opium.pdf | access-date = 2011-09-14}}</ref> Many artifacts result from builds but other types are crucial as well. Packages are essentially one of two things: a library or an application.<ref>{{Cite web| title=Linux repository classification schemes | date=13 January 2006| url=http://braintickle.blogspot.com/2006/01/linux-repository-classification.html|publisher=braintickle.blogspot.com | access-date=2008-03-01}}</ref>

Compared to source files, binary artifacts are often larger by orders of magnitude, they are rarely deleted or overwritten (except for rare cases such as snapshots or nightly builds), and they are usually accompanied by much metadata such as id, package name, version, license and more.

Line 226:

== See also ==

{{Div col|colwidth=20em}}

* [[Package manager]]

* [[RPM Package Manager]]

* [[Synaptic (software)|Synaptic]]

* [[FreeBSD Ports]]

* [[Definitive Media Library]]

Line 236 ⟶ 235:

* [[Simtel]]

* [[APTonCD]]

{{div col end}}