View source for Package manager

{{Short description|Application for handling software}}
{{More citations needed|date=December 2022}}
{{Use dmy dates|date=June 2022}}
[[File:Synaptic screenshot.png|thumb|[[Synaptic (software)|Synaptic]], an example of a [[Graphical user interface|GUI]] for the [[APT (software)|APT]] package manager]]

A '''package manager''' or '''package management system''' ('''PMS''') is a collection of [[programming tool|software tools]] that automates the process of [[Installation (computer programs)|installing]], upgrading, configuring, and removing [[computer program]]s for a [[computer]] in a consistent manner.<ref>{{cite web |title=What is a package manager? |url=https://www.debian.org/doc/manuals/aptitude/pr01s02.en.html |url-status=dead |archive-url=https://web.archive.org/web/20171017151526/http://aptitude.alioth.debian.org/doc/en/pr01s02.html |archive-date=17 October 2017 |access-date=19 December 2018 |website=debian.org}}</ref>

A package manager deals with ''[[package format|packages]]'', distributions of software and data in [[archive file]]s. Packages contain [[metadata]], such as the software's name, description of its purpose, [[version number]], vendor, [[checksum]] (usually a [[cryptographic hash function]]), and a list of [[coupling (computer programming)|dependencies]] necessary for the software to run properly. Upon installation, metadata is stored in a local package [[database]]. Package managers typically maintain a database of software dependencies and version information to prevent software mismatches and missing prerequisites. They work closely with [[software repositories]], [[binary repository manager]]s, and [[app store]]s.

Package managers are designed to eliminate the need for manual installs and updates. This can be particularly useful for large enterprises whose [[operating system]]s (OSes) typically consist of hundreds or even tens of thousands of distinct packages.<ref>{{cite web |url=http://software.dell.com/products/kace-k1000-systems-management-appliance/software-distribution.aspx |title=Software Distribution |access-date=2012-07-11 |publisher=Dell KACE |url-status=dead |archive-url=https://web.archive.org/web/20151003031633/http://software.dell.com/products/kace-k1000-systems-management-appliance/software-distribution.aspx |archive-date=3 October 2015}}</ref>

== History ==
An early package manager was [[System Management Interface Tool|SMIT]] (and its [[Backend (computing)|backend]] install) from [[IBM AIX]]. SMIT was introduced with AIX 3.0 in 1989.{{Citation needed|date=July 2007}} Package managers like [[dpkg]] have existed as early as 1994.<ref>{{cite web |title=dpkg version 0.93.15 source code |url=https://anonscm.debian.org/cgit/dpkg/dpkg.git/plain/scripts/perl-dpkg.pl?id=1b80fb16c22db72457d7a456ffbf1f70a8dfc0a5 |url-status=dead |archive-url=https://web.archive.org/web/20150402141229/https://anonscm.debian.org/cgit/dpkg/dpkg.git/plain/scripts/perl-dpkg.pl?id=1b80fb16c22db72457d7a456ffbf1f70a8dfc0a5 |archive-date=2 April 2015 |access-date=19 December 2018}}</ref> Early package managers, from around 1994, had no automatic [[Software dependency|dependency resolution]]<ref>{{cite web |url=https://eerielinux.wordpress.com/2017/08/15/the-history-of-nix-package-management/ |title=The history of *nix package management |date=14 August 2017 |access-date=12 October 2021 |archive-date=24 October 2021 |archive-url=https://web.archive.org/web/20211024173626/https://eerielinux.wordpress.com/2017/08/15/the-history-of-nix-package-management/ |url-status=live }}</ref> but could already simplify the process of adding and removing software from a running system.<ref>{{cite web |url=https://www.linuxjournal.com/article/60 |title=A review of InfoMagic's December 1994 Release |access-date=12 October 2021 |archive-date=29 October 2021 |archive-url=https://web.archive.org/web/20211029171535/https://www.linuxjournal.com/article/60 |url-status=live }}</ref>

By around 1995, beginning with [[CPAN]], package managers began handling package repository downloads, and dependency resolution and installation as needed, making it easier to install, uninstall and update software.<ref>{{cite web |url=http://history.perl.org/PerlTimeline.html |title=The Timeline of Perl and its Culture |access-date=29 October 2021 |archive-date=11 January 2013 |archive-url=https://web.archive.org/web/20130111100906/http://history.perl.org/PerlTimeline.html |url-status=live }}</ref>

==Functions==
[[File:Pms.svg|thumb|Illustration of a package manager being used to [[download]] new software. Manual actions can include accepting a [[software license agreement]] or selecting package-specific configuration options.]]

A software package is an [[archive file]] containing a computer program as well as necessary metadata for its [[Software deployment|deployment]]. The program may be in [[source code]] that has to be [[compiled]] and built first.<ref>Ludovic Courtès, [https://arxiv.org/abs/1305.4584 Functional Package Management with Guix] {{Webarchive|url=https://web.archive.org/web/20200515101137/https://arxiv.org/abs/1305.4584 |date=15 May 2020 }}, June 2013, Madrid, European Lisp Symposium 2013</ref> Package metadata include the software's description, version number, and dependencies.

Package managers are charged with the task of finding, installing, maintaining or uninstalling packages upon the user's command. Typical functions of a package management system include:
*Using [[file archiver]]s to extract package archives
*Ensuring the integrity and authenticity of the package by verifying their [[checksum]]s and [[digital certificate]]s, respectively
*Looking up, downloading, installing, or updating existing software from a [[software repository]] or [[app store]]
*Grouping packages by function to reduce user confusion
*Managing dependencies to ensure a package is installed with all the packages it requires, and avoiding ''[[dependency hell]]''

===Challenges with shared libraries===
Computer systems that rely on [[dynamic library]] linking, instead of [[static library]] linking, share executable libraries of machine instructions across packages and applications. In these systems, conflicting relationships between different packages requiring different versions of libraries results in a situation called ''dependency hell''. On [[Microsoft Windows]] systems, this is also called ''[[DLL hell]]'' when working with dynamically-linked libraries.<ref name="sharedlibrary">{{cite book |first= Chris |last= Tucker |title= 29th International Conference on Software Engineering (ICSE'07) |chapter= OPIUM: Optimal Package Install/Uninstall Manager |publisher= UC San Diego |date= 2007-03-15 |page=1 |doi=10.1109/ICSE.2007.59 |isbn= 978-0-7695-2828-1 |s2cid= 1279451 |url= https://escholarship.org/uc/item/1k07h5vk |chapter-url= http://cseweb.ucsd.edu/~lerner/papers/opium.pdf |archive-url=https://web.archive.org/web/20110614051810/http://cseweb.ucsd.edu/~lerner/papers/opium.pdf |archive-date=2011-06-14 |url-status=live |access-date= 2011-09-14}}</ref>

Modern{{When|date=September 2025}} package managers have mostly solved these problems by allowing parallel installation of multiple library versions (e.g. [[OPENSTEP]]'s ''Framework'' system), a dependency of any kind (e.g. ''slots'' in Gentoo [[Portage (software)|Portage]]), and even packages compiled with different compiler versions (e.g. dynamic libraries built by the [[Glasgow Haskell Compiler]], where a stable [[Application binary interface|ABI]] does not exist), in order to enable other packages to specify which version they are linked or installed against.

===Front-ends for locally-compiled packages===
[[System administrator]]s may install and maintain software using tools other than package managers. For example, a local administrator may [[download]] unpackaged source code, compile it, and install it. This may cause the local system to fall out of [[synchronization (computer science)|synchronization]] with the package manager's [[database]]. The local administrator will be required to take additional measures, such as manually managing some dependencies or integrating the changes into the package manager.

There are tools to ensure that locally-compiled packages are integrated with the package management. For operating systems based on [[.deb]] and [[.rpm]] files as well as [[Slackware|Slackware Linux]], there is [[CheckInstall]], and for recipe-based systems such as [[Gentoo Linux]] and hybrid systems such as [[Arch Linux]], it is possible to write a recipe first, which then ensures that the package fits into the local package database.{{Citation needed|date=July 2007}}

===Maintenance of configuration===
[[Upgrade]]s of [[configuration file]]s may be particularly troublesome. Since package managers, at least on [[Unix system]]s, originated as extensions of file archivers, they can usually only overwrite or retain configuration files, rather than apply rules to them. There are exceptions to this that usually apply to [[Kernel (operating system)|kernel]] configuration (which, if broken, will render the computer unusable after a restart). Problems can be caused if the configuration file format changes; for instance, if the old file does not explicitly disable new options that should be disabled. Some package managers, such as [[Debian]]'s dpkg, allow configuration during installation. In other situations, packages are installed with the default configuration, which is then overwritten, for example in [[Headless computer|headless]] installations to a large number of computers. This kind of pre-configured installation is also supported by dpkg.

===Repositories===
To give users more control over the software they allow to be installed on their systems, and sometimes due to legal or convenience reasons on the distributors' side, packages are often downloaded from [[software repositories]].<ref>{{cite web |title=Linux repository classification schemes |date=13 January 2006 |url=http://braintickle.blogspot.com/2006/01/linux-repository-classification.html |publisher=braintickle.blogspot.com |access-date=2008-03-01 |archive-date=11 October 2007 |archive-url=https://web.archive.org/web/20071011053815/http://braintickle.blogspot.com/2006/01/linux-repository-classification.html |url-status=live }}</ref>{{better citation needed|date=September 2025}}

===Upgrade suppression===
When a user is upgrading a package with package management software, it is customary for them to be presented with the actions to be executed (usually the list of packages to be upgraded, and possibly the old and new version numbers), and allow them to either accept the upgrade in bulk, or select individual packages for upgrading. Many package managers can be configured to never upgrade certain packages, or to upgrade them only when critical [[Vulnerability (computer security)|vulnerabilities]] or instabilities are found in the previous version, as defined by the packager of the software. This process is called ''upgrade suppression'', or ''version pinning''. For instance, to prevent upgrades to the [[OpenOffice.org|OpenOffice]] program:
*[[Yum (software)|yum]] supports upgrade suppression with the [[Syntax (programming languages)|syntax]] <code>exclude=openoffice*</code><ref>{{cite web |title=CentOS yum pinning rpms|url=http://lists.centos.org/pipermail/centos/2005-May/046320.html|publisher=centos.org|access-date=2008-03-01 |url-status=unfit |archive-url= https://web.archive.org/web/20071102203232/http://lists.centos.org/pipermail/centos/2005-May/046320.html |archive-date= 2007-11-02}}</ref>
*[[Pacman (package manager)|pacman]] with <code>IgnorePkg= openoffice</code><ref name=pacman/> (to suppress upgrading openoffice in both cases)
*[[dpkg]] and [[dselect]] support partial suppression through the ''hold'' [[Flag (programming)|flag]] in package selections
*[[APT (software)|APT]] extends the ''hold'' flag through a pinning mechanism,<ref>{{cite web|title=How to keep specific versions of packages installed (complex)|url=https://www.debian.org/doc/manuals/apt-howto/ch-apt-get.en.html#s-pin|publisher=debian.org|access-date=2008-03-01|archive-date=14 November 2019|archive-url=https://web.archive.org/web/20191114111450/https://www.debian.org/doc/manuals/apt-howto/ch-apt-get.en.html#s-pin|url-status=dead}}</ref> and users can also [[Blacklist (computing)|blacklist]] a package<ref>{{cite web|title=Apt pinning to blacklist a package|url=http://linux.derkeiler.com/Mailing-Lists/Debian/2009-07/msg00476.html|access-date=2010-08-19|archive-url=https://web.archive.org/web/20110722062625/http://linux.derkeiler.com/Mailing-Lists/Debian/2009-07/msg00476.html|archive-date=22 July 2011|url-status=dead}}</ref>
*[[Aptitude (software)|aptitude]] uses ''hold'' and ''forbid'' flags{{Explain|date=September 2025|reason=What does each flag do?}}
*[[Portage (software)|portage]] supports suppression through the package.mask configuration file
<!--(DotPet from .PET packages in [[Puppy Linux]], but is efficient in console and lightweight ?? -->

===Cascading package removal===
Some of the more advanced package management features offer ''cascading package removal'',<ref name=pacman>{{cite web|title=pacman(8) Manual Page|url=https://www.archlinux.org/pacman/pacman.8.html|website=archlinux.org|access-date=2008-03-01|archive-date=31 August 2019|archive-url=https://web.archive.org/web/20190831034550/https://www.archlinux.org/pacman/pacman.8.html|url-status=live}}</ref> in which all packages that depend on the target package and all packages that only it depends on are also removed.

===Comparison of commands===
{{Excessive examples|date=September 2025|section}}
Although commands are specific to each package manager, they are translatable to a large extent, as most package managers offer similar functions. The Arch Linux wiki offers an extensive overview of commands.<ref>{{cite web |title=Pacman/Rosetta – ArchWiki |url=https://wiki.archlinux.org/index.php/Pacman/Rosetta |url-status=live |archive-url=https://web.archive.org/web/20161120213631/https://wiki.archlinux.org/index.php/Pacman/Rosetta |archive-date=20 November 2016 |access-date=2017-09-17 |website=wiki.archlinux.org |language=en}}</ref>
<div style="width: 100%; overflow: auto;">
{| class="wikitable plainrowheaders" style="font-size:75%"
|+ style="caption-side: bottom; text-align:left;" | {{code|lang=sh|${PKG} }} or {{code|lang=dosbatch|%PKG% }} is the package name.
! Action
! [[Homebrew (package manager)|Homebrew]]
! [[APT (software)|APT]]
! [[Arch Linux#Pacman|Pacman]]
! [[DNF (software)|dnf]] ([[YUM (software)|yum]])
! [[portage (software)|portage]]||[[zypper]]<ref>{{cite web|url=https://en.opensuse.org/SDB:Zypper_manual_%28plain%29|title=documentation/sles11|website=en.opensuse.org|access-date=16 August 2017|archive-date=1 December 2022|archive-url=https://web.archive.org/web/20221201032709/https://en.opensuse.org/SDB:Zypper_manual_(plain)|url-status=live}}</ref>
! [[Nix (package manager)|Nix]]
! [[Void Linux|XBPS]]<ref>{{Cite web |title=XBPS Package Manager - Void Linux Handbook |url=https://docs.voidlinux.org/xbps/ |access-date=2022-12-19 |website=docs.voidlinux.org |archive-date=23 January 2023 |archive-url=https://web.archive.org/web/20230123092810/https://docs.voidlinux.org/xbps/ |url-status=live}}</ref>
! [[Clear Linux OS|swupd]]<ref>{{cite web|url=https://github.com/clearlinux/swupd-client/blob/master/docs/swupd.1.rst|title=swupd-client/swupd.1.rst at master: clearlinux/swupd-client|website=GitHub.com|language=en|access-date=2022-06-22|archive-date=7 December 2022|archive-url=https://web.archive.org/web/20221207105625/https://github.com/clearlinux/swupd-client/blob/master/docs/swupd.1.rst|url-status=live}}</ref>
! [[Windows Package Manager|WinGet]]
|-
! scope=row | Install package
| {{code|lang=sh|style=white-space:nowrap;|brew install ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|apt install ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|pacman -S ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|dnf install ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|emerge ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|zypper in ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|nix-env -i ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|xbps-install ${PKG<nowiki>}</nowiki>}}
| {{code|lang=sh|style=white-space:nowrap;|swupd bundle-add ${PKG} }}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget install %PKG% }}
|-
! scope=row | Remove package
| {{code|lang=sh|brew uninstall ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|apt remove ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|pacman -R ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|dnf remove --nodeps ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|emerge -C ${PKG} }} or <br />{{code|lang=sh|style=white-space:nowrap;|emerge --unmerge ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|zypper rm -RU ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|nix-env -e ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|xbps-remove ${PKG<nowiki>}</nowiki>}}
| {{code|lang=sh|style=white-space:nowrap;|swupd bundle-remove ${PKG} }}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget uninstall %PKG% }}
|-
! scope="row" | Update software database
| {{code|lang=sh|style=white-space:nowrap;|brew update}}
| {{code|lang=sh|style=white-space:nowrap;|apt update}}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Sy}}
| {{code|lang=sh|style=white-space:nowrap;|dnf check-update}}
| {{code|lang=sh|style=white-space:nowrap;|emerge --sync}}
| {{code|lang=sh|style=white-space:nowrap;|zypper ref}}
| {{code|lang=sh|style=white-space:nowrap;|nix-channel --upgrade}}
| {{code|lang=sh|style=white-space:nowrap;|xbps-install -S}}
| {{code|lang=sh|style=white-space:nowrap;|swupd update --download}} or <br />{{code|lang=sh|style=white-space:nowrap;|swupd update --update-search-file-index}}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget upgrade}}
|-
! scope="row" | Show updatable packages
| {{code|lang=sh|style=white-space:nowrap;|brew outdated}}
| {{code|lang=sh|style=white-space:nowrap;|apt list --upgradable}}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Qu}}
| {{code|lang=sh|style=white-space:nowrap;|dnf check-update}}
| {{code|lang=sh|style=white-space:nowrap;|emerge -avtuDN --with-bdeps{{#tag:nowiki|=}}y @world}} or <br />{{code|lang=sh|style=white-space:nowrap;|emerge -u --pretend @world}}<br />({{code|-D}} is shorthand for {{code|--deep}} and<br />{{code|-u}} is shorthand for {{code|--update}}.)
| {{code|lang=sh|style=white-space:nowrap;|zypper lu}}
| {{sxhl|lang=sh|nix-channel --upgrade && \
nix-env -u && \
nix-collect-garbage}}
| {{code|lang=sh|style=white-space:nowrap;|./xbps-src update-check ${PKG<nowiki>}</nowiki>}}(requires void-packages repository)
| {{code|lang=sh|style=white-space:nowrap;|swupd update -s}} or <br />{{code|lang=sh|style=white-space:nowrap;|swupd check-update}}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget upgrade}}
|-
! scope="row" | Update all
| {{code|lang=sh|style=white-space:nowrap;|brew upgrade}}
| {{code|lang=sh|style=white-space:nowrap;|apt upgrade}}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Syu}}
| {{code|lang=sh|style=white-space:nowrap;|dnf update}}
| {{code|lang=sh|style=white-space:nowrap;|emerge -u -D --with-bdeps{{#tag:nowiki|=}}y @world}}
| {{code|lang=sh|style=white-space:nowrap;|zypper up}}
| {{code|lang=sh|style=white-space:nowrap;|nix-env -u && nix-collect-garbage}}
| {{code|lang=sh|style=white-space:nowrap;|xbps-install -Su}}
| {{code|lang=sh|style=white-space:nowrap;|swupd update}}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget upgrade --all}}
|-
! scope="row" | Delete orphans and config
| {{code|lang=sh|style=white-space:nowrap;|brew autoremove && brew cleanup}}
| {{code|lang=sh|style=white-space:nowrap;|apt autoremove}}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Rsn $(pacman -Qdtq)}}
| {{N/A}}
| {{code|lang=sh|style=white-space:nowrap;|emerge --depclean}}
| {{code|lang=sh|style=white-space:nowrap;|zypper rm -u}}
| {{code|lang=sh|style=white-space:nowrap;|nix-collect-garbage -d}}
| {{code|lang=sh|style=white-space:nowrap;|xbps-remove -of}}
| style="white-space:nowrap;" | {{sxhl|lang=sh|swupd bundle-remove --orphans && \
swupd clean --all}}
| {{N/A}}
|-
! scope="row" | Show orphans
| {{code|lang=sh|style=white-space:nowrap;|brew autoremove --dry-run}}
| {{N/A}}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Qdt}}
| {{code|lang=sh|style=white-space:nowrap;|package-cleanup -q --leaves --exclude-bin}}<br />({{code|-q}} is shorthand for {{code|--quiet}}.)
| {{code|lang=sh|style=white-space:nowrap;|emerge -caD}} or <br />{{code|lang=sh|style=white-space:nowrap;|emerge --depclean --pretend}}
| {{code|lang=sh|style=white-space:nowrap;|zypper pa --orphaned --unneeded}}
| {{N/A}}
| {{code|lang=sh|style=white-space:nowrap;|xbps-remove -o}}
| {{code|lang=sh|style=white-space:nowrap;|swupd bundle-list --orphans}}
| {{N/A}}
|-
! scope=row | Remove package (and orphans)
| style="white-space:nowrap;" | {{sxhl|lang=sh|brew uninstall ${PKG} && brew autoremove}}
| {{code|lang=sh|style=white-space:nowrap;|apt autoremove ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|pacman -Rs ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|dnf remove ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|emerge -c ${PKG} }} or <br />{{code|lang=sh|style=white-space:nowrap;|emerge --depclean ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|zypper rm -u --force-resolution ${PKG} }}
| {{code|lang=sh|style=white-space:nowrap;|nix-env -e ${PKG} && nix-env -u}}
| {{code|lang=sh|style=white-space:nowrap;|xbps-remove -R ${PKG<nowiki>}</nowiki>}}
| style="white-space:nowrap;" | {{sxhl|lang=sh|swupd bundle-remove ${PKG} && \
swupd bundle-remove --orphans}}
| {{code|lang=dosbatch|style=white-space:nowrap;|winget uninstall %PKG% }}
|}
</div>
==Prevalence==
[[Linux distribution]]s oriented to [[Binary file|binary]] packages rely heavily on package management systems as their primary means of managing and maintaining software. [[Mobile operating systems]] such as [[Android (operating system)|Android]] (Linux-based) and [[iOS]] ([[Unix|Unix-based]]) rely almost exclusively on their respective vendors' app stores and thus use their own dedicated package management systems.

<gallery mode="packed">
File:Apt-get install mediawiki.png|<code>apt-get</code>, a [[Command-line interface|CLI]] utility installing [[MediaWiki]]
File:Aptitude 0.4.11.3 de.png|[[Aptitude (software)|Aptitude]] features a [[text-based user interface|TUI]]
File:Synaptic_screenshot.png|[[Synaptic (software)|Synaptic]], a GUI for many Linux package managers
File:Example of pacman in Arch Linux screenshot.png|<code>pacman</code>, a CLI utility for [[Arch Linux|Arch]]-based distributions
File:Octopi 0.12.0 screenshot.png|Octopi, a [[Qt (software)|Qt]] GUI for Pacman
File:Pamac 10.3.0 screenshot.png|Pamac, a [[GTK+]] GUI for Pacman
File:Kpackagekit.png|[[Apper]], a Qt GUI for [[PackageKit]]
File:Gnome-software-v44.png|[[GNOME Software]], a [[GTK]] GUI for PackageKit and [[Flatpak]]
File:Windows Package Manager v0.1.41331 Preview 1115x624.png|<code>winget</code>, the [[Windows Package Manager]] CLI for [[Windows 10]] and [[Windows 11|11]]
</gallery>

== Similar programs and platforms ==

=== Installers ===
A package manager is often called an ''install manager'', which can lead to a confusion between package managers and [[installer]]s. The differences include:

{{PMS vs Installer}}

=== Build automation utilities ===
Most [[software configuration management]] systems treat building software and deploying software as separate, independent steps. A [[build automation]] utility typically takes human-readable [[source code]] files already on a computer, and automates the process of converting them into an [[executable]] package on the same or a remote computer. Later, a package manager typically running on another computer downloads the pre-built executable and installs it.

However, both kinds of tools have many commonalities:
*[[Topological sorting]] of the [[dependency graph]] used in a package manager to handle dependencies between binary components is also used in a build manager to handle dependencies between source components.
*Many [[makefile]]s support not only building executables, but also installing them with <code>make install</code>.
*Every package manager for a [[:Category:Source-based Linux distributions|source-based distribution]]{{snd}}such as [[Portage (software)|Portage]], [[Sorcery (package manager)|Sorcery]], or [[Homebrew (package manager)|Homebrew]]{{snd}}supports converting source code to binary executables and installing it.

A few tools, such as [[Maak]] and [[A-A-P]], are designed to handle both building and deployment, and can be used as either build automation utilities, package managers, or both.<ref>Eelco Dolstra, [https://nixos.org/~eelco/pubs/iscsd-scm11-submitted.pdf "Integrating Software Construction and Software Deployment"]. {{Webarchive|url=https://web.archive.org/web/20190921030912/https://nixos.org/~eelco/pubs/iscsd-scm11-submitted.pdf |date=21 September 2019 }}.</ref>

=== App stores ===
[[App stores]] can also be considered application-level package managers (without the ability to install all levels of programs<ref>{{cite news |title=Brew is the macOS app store replacement you didn't know you needed |url=https://www.msn.com/en-us/news/technology/brew-is-the-macos-app-store-replacement-you-didn-t-know-you-needed/ar-BB1mK6Ys |access-date=25 May 2024 |work=www.msn.com}}</ref><ref name="comp">{{cite web |last1=King |first1=Bertel |title=Linux App Stores Compared: Which One Is Right for You? |url=https://www.makeuseof.com/tag/linux-app-stores-compared/ |website=MUO |access-date=25 May 2024 |language=en |date=17 March 2017}}</ref>). Unlike traditional package managers, app stores are designed to enable payment for the software itself (instead of for software development), and may only offer [[Monolithic application|monolithic]] packages with no dependencies or dependency resolution.<ref>{{cite web |title=What is a package manager? |url=https://www.debian.org/doc/manuals/aptitude/pr01s02.en.html |website=www.debian.org}}</ref><ref name="comp" /> They are usually limited in their management functionality, due to focusing on ease-of-use over power or [[emergent structures|emergence]], and are common in commercial operating systems and [[smart device]]s.

Package managers also often have only human-reviewed code. Many app stores, such as Google Play and Apple's App Store, mainly screen apps using automated tools only; [[malware]] can pass these tests by detecting when the app is being tested, and delaying malicious activity.<ref>{{cite magazine |last1=Barrett |first1=Brian |title=How 18 Malware Apps Snuck Into Apple's App Store |url=https://www.wired.com/story/apple-app-store-malware-click-fraud/ |magazine=Wired}}</ref><ref>{{cite web |last1=Whittaker |first1=Zack |title=Millions downloaded dozens of Android apps from Google Play that were infected with adware |url=https://techcrunch.com/2019/10/24/millions-dozens-android-apps-adware/ |website=TechCrunch |date=24 October 2019}}</ref><ref>{{cite magazine |last1=Newman |first1=Lily Hay |title=Never Ever (Ever) Download Android Apps Outside of Google Play |url=https://www.wired.com/2016/12/never-ever-ever-download-android-apps-outside-google-play/ |magazine=Wired}}</ref> There are exceptions: the [[npm]] package database, for instance, relies entirely on [[postpublication review]] of its code,<ref name="OjamaaDuuna12">{{cite book|last1=Ojamaa|first1=Andres|last2=Duuna|first2=Karl|chapter=Assessing the Security of Node.js Platform|title=2012 International Conference for Internet Technology and Secured Transactions | publisher = IEEE |date=2012|chapter-url=https://ieeexplore.ieee.org/document/6470829|access-date=22 July 2016|isbn= 978-1-4673-5325-0 }}</ref><ref>{{cite web |title=npm Code of Conduct: acceptable package content |url=https://docs.npmjs.com/policies/conduct#acceptable-package-content |access-date=9 May 2017}}</ref> while the Debian package database has an extensive human review process before any package goes into the main database. The [[XZ Utils backdoor]] used years of trust-building to insert a backdoor, which was nonetheless caught while in the [[Test environment|testing database]].

==Common package managers and formats==

===Universal package manager===
Also known as [[binary repository manager]], it is a software tool designed to optimize the download and storage of binary files, artifacts and packages used and produced in the [[software development process]].<ref>{{cite web |url= https://adtmag.com/articles/2015/09/08/jfrog-repository.aspx |title= JFrog Releases 'Universal' Artifact Repository |last= Waters |first= John K. |date= 8 September 2015 |website= ADT Mag |publisher= Application Development Trends Magazine |access-date= 19 February 2016 |archive-date= 2 March 2016 |archive-url= https://web.archive.org/web/20160302162053/https://adtmag.com/articles/2015/09/08/jfrog-repository.aspx |url-status= live }}</ref> These package managers aim to standardize the way enterprises treat all package types. They give users the ability to apply security and compliance metrics across all artifact types. Universal package managers have been referred to as being at the center of a [[DevOps toolchain]].<ref>{{cite web |url=https://www.codeproject.com/Reference/628210/An-Overview-of-the-NuGet-Ecosystem |title=An Overview of the NuGet Ecosystem |last=Decoster |first=Xavier |date=18 August 2013 |website=CodeProject.com |access-date=6 February 2020 |archive-date=5 July 2020 |archive-url=https://web.archive.org/web/20200705022618/https://www.codeproject.com/Reference/628210/An-Overview-of-the-NuGet-Ecosystem |url-status=live }}</ref>

===Package formats===
{{Main article|Package format|File archive}}
Each package manager relies on the format and metadata of the packages in its repository. That is, package managers need groups of files to be bundled along with appropriate metadata, such as dependencies. Often, a core set of utilities manages the basic installation from these packages and multiple package managers use these utilities to provide additional functionality.

For example, [[Yum (software)|yum]] relies on [[RPM Package Manager|rpm]] as a [[Backend (computing)|backend]]. Yum extends the functionality of rpm by adding features such as simple configuration for maintaining a network of systems. As another example, the [[Synaptic Package Manager]] provides a graphical user interface by using the [[Advanced Packaging Tool]] (apt) library, which in turn relies on [[dpkg]] for core functionality.

[[Alien (file converter)|Alien]] is a program that converts between different [[Linux package formats]], supporting conversion between [[Linux Standard Base]] (LSB) compliant [[.rpm]] packages, [[deb (file format)|.deb]], Stampede (.slp), [[Solaris (operating system)|Solaris]] (.pkg) and [[Slackware]] ([[.tgz]], [[.txz]], .tbz, .tlz) packages.

For mobile operating systems, [[Google Play]] uses the [[Android application package]] (APK) package format while [[Microsoft Store]] uses the [[APPX]] and [[XAP (file format)|XAP]] formats. Both Google Play and Microsoft Store have eponymous package managers.

===Free and open source software systems===
By the nature of [[free and open-source software]] (FOSS), packages under similar and compatible licenses are available on a number of operating systems. These packages can be combined and distributed using configurable packaging systems to handle many permutations of software and manage version-specific dependencies and conflicts. Some managers of FOSS packages are released as FOSS themselves. One typical difference between package management in proprietary operating systems, such as Mac OS X and Windows, and those in free and open source software, such as Linux, is that free and open source software systems permit third-party packages to also be installed and upgraded through the same mechanism, whereas the package managers of Mac OS X and Windows will only upgrade software provided by Apple and Microsoft, respectively (with the exception of some third party drivers in Windows). The ability to continuously upgrade third-party software is typically added by adding the [[URL]] of the corresponding repository to the package management's configuration file.

===Application-level package managers===
{{See also|List of software package management systems#Application-level package managers}}

Besides system-level application managers, there are add-on package managers for operating systems with limited capabilities and for [[programming language]]s in which developers need the latest [[Library (computing)|libraries]].

Unlike system-level package managers, application-level package managers focus on a small part of the software system. They typically reside within a [[directory tree]] that is not maintained by the system-level manager, such as {{Mono|c:\cygwin}} or {{Mono|/opt/sw}}.<ref>{{Cite web|title=Fink – Home|url=https://www.finkproject.org/index.php|access-date=2021-09-02|website=finkproject.org|archive-date=18 August 2021|archive-url=https://web.archive.org/web/20210818055630/https://finkproject.org/index.php|url-status=live}}</ref> This may not be the case for managers that deal with programming libraries, leading to possible conflicts, as both managers may claim to own a file and may break upgrades.

==Impact==
[[Ian Murdock]] commented that package management is "the single biggest advancement [[Linux]] has brought to the industry", that it blurs the boundaries between operating systems and applications, and that it makes it "easier to push new innovations [...] into the marketplace and [...] evolve the OS".<ref>{{cite web |title=How package management changed everything|url=http://ianmurdock.com/2007/07/21/how-package-management-changed-everything/|publisher=ianmurdock.com|access-date=2008-03-01|url-status=dead|archive-url=https://web.archive.org/web/20090223072201/http://ianmurdock.com/2007/07/21/how-package-management-changed-everything/|archive-date=23 February 2009}}</ref>{{Self-published source|date=September 2025}}

There is also a conference for package manager developers known as PackagingCon. It was established in 2021 with the aim to understand different approaches to package management.<ref>{{Cite web|title=PackagingCon 2021 – a conference for package manager developers and packagers|url=https://packaging-con.org/|access-date=2021-09-02|website=packaging-con.org|archive-date=2 September 2021|archive-url=https://web.archive.org/web/20210902144959/https://packaging-con.org/|url-status=live}}</ref>

==See also==
* [[Application strings manager]]
* [[List of software package management systems]]
* [[Manifest file]]
* [[Package format]]

==References==
{{Reflist}}

==External links==
*[http://distrowatch.com/dwres.php?resource=package-management Package Management Cheatsheet] from Distrowatch
*[https://wiki.archlinux.org/index.php/Pacman/Rosetta Arch Linux Wiki Pacman/Rosetta – Command-line comparison for package managers]
*[https://github.com/Inducido/upkg-package-manager-rosetta-stone upkg – universal package manager] a [[Wrapper function|wrapper]] that provides the same syntax for all flavors of Linux

{{Package management systems}}
{{Software digital distribution platforms}}

[[Category:Package management systems| ]]
[[Category:Software distribution]]
[[Category:Types of tools used in software development]]