Package format explained

Package format is a type of archive containing computer programs and additional metadata needed by package managers;[1] an instance of this type of archive is called a package. While the archive file format itself may be unchanged, package formats carry additional metadata, such as a manifest file or certain directory layouts. Packages may contain either source code or executable files.

Packages may be converted from one type to another with software such as Alien.

Software supply chain and security

Packages are an important component in managing the security and integrity of the software supply chain. Packages containing executables and configuration can be digitally signed to establish the integrity of running software and protect against tampering.[2]

Package formats that support code signing include .deb (Debian), .msi (Microsoft Windows), .apk (Android) and .ipa (IOS, IPadOS).

Common formats

Specialized formats

FormatConsumed by
AABAndroid
AIRAdobe AIR
APK (Alpine)Alpine Linux[3]
APK (Android)Android
AppImageLinux distribution-agnostic
APPX and APPXBundleWindows 8 and later, Windows Phone[4]
BottleHomebrew
DebDebian and its derivatives, such as Raspberry Pi OS, Kali Linux, Ubuntu, and Linux Mint[5]
ebuildGentoo Linux[6]
eopkgSolus[7]
.ipaIOS, IPadOS
NixpkgNix, NixOS, Home Manager
PortageGentoo Linux, ChromeOS[8]
Ports (BSD)pkgsrc, FreeBSD, OpenBSD[9]
FlatpakLinux distribution-agnostic
.app, .hapHarmonyOS, OpenHarmony, Oniro OS and Linux based Unity Operating System
PISIPardus
PKGmacOS, iOS, PlayStation 3, Solaris, SunOS, UNIX System V, Symbian, BeOS, Apple Newton
.pkg.tar.zstArch Linux
PUP and PETPuppy Linux (PUP format is deprecated since version 3.0)
RPMRed Hat Enterprise Linux, Fedora, derivatives such as CentOS,[10] and SUSE Linux Enterprise, openSUSE
Snap
Windows Installer package / MSIWindows Installer on Microsoft Windows

Generic formats

Arch Linux's Pacman[11] and Slackware[12] use 'tar' archives with generic naming but specific internal structures.

Notes and References

  1. Justin Angelo Cappos, Stork: Secure Package Management for VM Environments, ProQuest, 2008, p. 128;
  2. Web site: Protecting Software Integrity Through Code Signing. . ITL Bulletin . David . Cooper . Larry . Feldman . Gregory . Witte . May 23, 2018.
  3. Web site: Alpine package format - Alpine Linux. wiki.alpinelinux.org. 2016-05-19.
  4. Web site: App packaging. 29 September 2014.
  5. Web site: InstallingSoftware - Community Ubuntu Documentation. Help.ubuntu.com. 2013-04-24.
  6. Web site: ebuild. 29 July 2015.
  7. Web site: Basics to Package Management. 1 May 2020.
  8. Web site: Using Portage to Manage Packages in Gentoo . linode.com.
  9. Web site: Ports - Working with Ports . OpenBSD.org.
  10. Web site: rpm - Trac. 29 September 2014.
  11. Web site: makepkg.conf(5) Manual Page.
  12. Web site: The Slackware Linux Project: Configuration Help. 29 September 2014.