12.1. Introduction to Packages
All Linux systems use some kind of software packaging system to simplify the process of installing and removing programs. A package is a collection of commands, configuration files, man pages, shared libraries, and other files that are associated with a single program like Apache or Sendmail, combined into a single package file. When it is installed, the package system extracts all the component files and places them in the correct locations on your system. Because the system knows which package every file came from, when you want to remove a package it knows exactly which files to delete.
On almost all versions of Linux, packages generally contain compiled programs that will only work on the CPU architecture that they were compiled for. Because Linux supports many different CPU types (x86, Alpha, and IA64 to name a few), some programs have packages compiled for several different CPUs. A package can only be installed on a system with the right CPU architecture—unless it is architecture-independent, in which case it will install on any system type. Programs written in languages like Perl (such as Webmin) or packages that contain only documentation are usually CPU-independent.
When a Linux distribution is installed, almost every file that is placed on the hard disk is a member of one of the distribution's packages. This makes it easy to remove unwanted software that was installed by default, or add additional software from the distribution CD or website.
Because some programs depend on other programs to operate, packages can have dependencies as well. Certain packages may fail to install unless you have installed another package first, and some packages may not be removable if others depend upon them. This system of dependencies protects the user from installing software that will not work due to a missing shared library or command.
Because the package system knows exactly which files are in each package, it can use that information to validate the files after installation. All package systems also keep track of the MD5 checksum for each file, so that any manual modifications to files in a package can be detected. This can be very useful for detecting unauthorized modifications, such as by an attacker who has cracked your system and replaced important commands like ls and find with modified versions. Unfortunately, on Linux there is more than one package system. The most common is RPM, which stands for Red Hat Package Manager. It is used by Red Hat, Caldera, SuSE, Mandrake, MSC, and a few other Linux distributions. It works well, and there is more software available in RPM format than any other package system. Installation, querying, and deletion of RPM packages is done using the rpm shell command.
The biggest competitor to RPM is Debian's DPKG package format. It is technically superior in many ways, particularly when it comes to dependencies—however, only Debian and a few other distributions use it. The dpkg and deselect commands are used at the shell prompt to manage Debian packages.
Another packaging system is Gentoo's Emerge, which is only available on Gentoo Linux. The biggest difference between Emerge and other package systems is that almost all packages contain source code, which is compiled when the package is installed. All Gentoo package installation and management is done using the emerge command.
Even though these package systems are internally different and use incompatible file formats, they all offer basically the same features. All allow multiple files related to the same program to be combined into one package file for easy installation and removal, and all support dependencies. Unfortunately, once you have chosen your Linux distribution it is very difficult to change to another packaging system, so you are stuck with what the distribution uses.
On most distributions that use RPM, packages are either installed from a distribution CD or downloaded from various sites on the Internet. Debian Linux, however, includes a command called apt-get that can automatically download and install packages from a repository run by the distribution maintainers. If the package depends on others that are not yet installed on your system, they will be automatically downloaded and installed as well. Because all packages in the repository are created and maintained by the same people, incompatibilities between them are reduced and dependencies easily resolved. The repository also contains a package for almost every free software program that you might want to install, so there is no need to search the Internet for the package that you want.
The Debian repository can also be used to update all the packages on your system to the latest version. Because new versions of packages come out frequently (especially when using the unstable or testing Debian releases), an update is an easy way of ensuring that you are running the latest version of everything. This can take a long time if you do not have a fast connection to the Internet though, as many new packages may be downloaded for each update.
Gentoo Linux's Emerge system also has a repository from which packages can be automatically downloaded and installed using the emerge command. Like Debian's apt-get, it automatically downloads and installs packages needed to fulfill dependencies.
Red Hat systems also have access to a package repository as part of the Red Hat Network. This allows updated packages to be selected on the Red Hat website and installed automatically or on request on multiple systems. Unlike the Debian and Gentoo repositories, it is not generally used for installing new packages.