Also known as: apt · dnf · pacman · dependency resolution
A package manager is the tool that installs, updates, configures, and removes software on a Linux system, resolving dependencies automatically and verifying package integrity through cryptographic signatures.
Beyond convenience, package managers are a security control. Signed repositories provide a trusted distribution channel, and centralised updating means a single command patches every managed component — the reason distribution packages remain preferable to vendor-supplied binaries where both exist.
Newer formats such as Flatpak and Snap bundle dependencies with the application to solve cross-distribution compatibility, at the cost of larger installations and the loss of centralised security patching for bundled libraries.
Linux Distribution
A Linux distribution is a complete operating system built around the Linux kernel, bundling it with system libraries, a package manager, default utilities, and a curated set of software, along with policies for how all of it is maintained and updated.
Dependency Confusion
Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.
Typosquatting
Typosquatting is the practice of registering package names or domains that closely resemble legitimate ones, relying on user typos or inattention to deliver malicious content to victims who intended to reach the real thing.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
Open Source
Open source software is software distributed under a licence that grants anyone the right to use, inspect, modify, and redistribute the source code, subject to conditions defined by that licence.