Software repository

A software repository, or “repo” for short, is a storage location for software packages. Often a table of contents is stored, as well as metadata. Repositories group packages. Sometimes the grouping is for a programming language, such as CPAN for the Perl programming language, sometimes for an entire operating system, sometimes the license of the contents is the criteria.
At client side, a package manager helps installing from and updating the repositories.
At server side, a software repository is typically managed by source control or repository managers. Some of the repository managers allow to aggregate other repository location into one URL and provide a caching proxy. When doing continuous builds many artifacts are produced and often centrally stored, so automatically deleting the ones which are not released is important.


Many software publishers and other organizations maintain servers on the Internet for this purpose, either free of charge or for a subscription fee. Repositories may be solely for particular programs, such as CPAN for the Perl programming language, or for an entire operating system. Operators of such repositories typically provide a package management system, tools intended to search for, install and otherwise manipulate software packages from the repositories. For example, many Linux distributions use Advanced Packaging Tool, commonly found in Debian based distributions, or yum found in Red Hat based distributions. There are also multiple independent package management systems, such as pacman, used in Arch Linux and equo, found in Sabayon Linux.
As software repositories are designed to include useful packages, major repositories are designed to be malware free. If a computer is configured to use a digitally signed repository from a reputable vendor, and is coupled with an appropriate permissions system, this significantly reduces the threat of malware to these systems. As a side effect, many systems that have these capabilities do not require anti-malware software such as anti-virus software.
Most major Linux distributions have many repositories around the world that mirror the main repository.

Package management system vs. package development process

A package management system is different from a package development process.
A typical use of a package management system is to facilitate the integration of code from possibly different sources into a coherent stand-alone operating unit. Thus, a package management system might be used to produce a distribution of Linux, possibly a distribution tailored to a specific restricted application.
A package development process, by contrast, is used to manage the co-development of code and documentation of a collection of functions or routines with a common theme, producing thereby a package of software functions that typically will not be complete and usable by themselves. A good package development process will help users conform to good documentation and coding practices, integrating some level of unit testing. The table below provides examples of package development processes.

Selected repositories

The following table lists a few languages with repositories for contributed software. The "Autochecks" column describes the routine checks done.
Very few people have the ability to test their software under multiple operating-systems with different versions of the core code and with other contributed packages they may use. For R, the Comprehensive R Archive Network runs tests routinely. To see how this is valuable, suppose Sally contributes a package A. Sally only runs the current version of the software under one version of Microsoft Windows, and has only tested it in that environment. At more or less regular intervals, CRAN tests Sally's contribution under a dozen combinations of operating systems and versions of the core R language software. If one of them generates an error, she gets that error message. With luck, that error message may suffice to allow her to fix the error, even if she cannot replicate it with the hardware and software she has. Next, suppose John contributes to the repository a package B that uses a package A. Package B passes all the tests and is made available to users. Later, Sally submits an improved version of A, which unfortunately, breaks B. The autochecks make it possible to provide information to John so he can fix the problem.
This example exposes both a strength and a weakness in the R contributed-package system: CRAN supports this kind of automated testing of contributed packages, but packages contributed to CRAN need not specify the versions of other contributed packages that they use. Procedures for requesting specific versions of packages exist, but contributors might not use those procedures.
Beyond this, a repository such as CRAN running regular checks of contributed packages actually provides an extensive if ad hoc test suite for development versions of the core language. If Sally gets an error message she does not understand or thinks is inappropriate, especially from a development version of the language, she can ask the core development-team for the language for help. In this way, the repository can contribute to improving the quality of the core language software.
Language / purposePackage Development ProcessRepositoryInstall methodsCollaborative development platformAutochecks
HaskellCommon Architecture for Building Applications and LibrariesHackage
Common LispQuicklisp
PHPPEAR, ComposerPECL, Packagist
PythonSetuptoolsPyPIpip, EasyInstall, PyPM, Anaconda
RR CMD check processCRANinstall.packagesR-ForgeRoughly weekly on 12 platforms or combinations of different versions of R with up to 7 different operating systems.
RubyRubyGemsRuby Application ArchiveRubyForge

Many other programming languages, among them C, C++, and Fortran, do not possess a central software repository with universal scope. Notable repositories with limited scope include:
help manage repositories and the distribution of them. If a repository is updated, a package manager will typically allow the user to update that repository through the package manager. They also help with managing things such as dependencies between other software repositories. Some examples of Package Managers include:
Package ManagerDescription
NPMA package manager for Node.js
pipA package installer for Python
APTFor managing Debian Packages
HomebrewA package installer for MacOS that allows you to install packages Apple didn't

Repository managers

Relationship to continuous integration

As part of the development lifecycle, source code is continuously being built into binary artifacts using continuous integration. This may interact with a binary repository manager much like a developer would by getting artifacts from the repositories and pushing builds there. Tight integration with CI servers enables the storage of important metadata such as:
Artifacts and packages inherently mean different things. Artifacts are simply an output or collection of files and one of those files may contain metadata. Whereas packages are a single archive file in a well-defined format that contain files appropriate for the package type. Many artifacts result from builds but other types are crucial as well. Packages are essentially one of two things: a library or an application.
Compared to source files, binary artifacts are often larger by orders of magnitude, they are rarely deleted or overwritten, and they are usually accompanied by much metadata such as id, package name, version, license and more.


describes a binary artifact, is stored and specified separately from the artifact itself, and can have several additional uses. The following table shows some common metadata types and their uses:
Metadata typeUsed for
Versions availableUpgrading and downgrading automatically
DependenciesSpecify other artifacts that the current artifact depends on
Downstream dependenciesSpecify other artifacts that depend on the current artifact
LicenseLegal compliance
Build date and timeTraceability
DocumentationProvide offline availability for contextual documentation in IDEs
Approval informationTraceability
MetricsCode coverage, compliance to rules, test results
User-created metadataCustom reports and processes

Products providing repository management

Software to manage repositories includes: