Package Management — Trivia & Interesting Facts¶
Surprising, historical, and little-known facts about Linux package management.
RPM was created by Red Hat in 1995 and is still the foundation of half the Linux world¶
RPM (Red Hat Package Manager, later recursive: RPM Package Manager) was created by Marc Ewing and Erik Troan for Red Hat Linux 2.0 in 1995. Every RHEL, Fedora, CentOS, SUSE, and Amazon Linux system uses RPM as its low-level package format. The .rpm file format uses cpio archives with a header containing metadata and dependency information.
Dependency hell was a real term coined in the 1990s¶
Before dependency-resolving package managers, installing software on Linux required manually finding and installing every library a package needed, each of which might need its own dependencies. This recursive nightmare was called "dependency hell" and was the #1 complaint about Linux until APT (1998) and Yum (2003) automated resolution. The term was modeled on "DLL hell" from Windows.
Flatpak, Snap, and AppImage solve the same problem three different ways¶
All three universal packaging formats bundle applications with their dependencies to avoid library conflicts. Flatpak (Red Hat/GNOME, 2015) uses OSTree and sandboxing. Snap (Canonical, 2014) uses SquashFS and AppArmor. AppImage (2004 as klik) is a single executable file with no installation. The fragmentation of three competing solutions has been called "the new dependency hell."
apt and apt-get are different commands¶
apt (introduced in 2014 with Debian Jessie) is a user-friendly frontend that combines the most-used features of apt-get, apt-cache, and apt-mark into one tool. It adds a progress bar and colored output. However, apt-get is still recommended for scripts because its output format is stable and its behavior is guaranteed not to change between versions.
The Arch User Repository has over 85,000 packages¶
The AUR (Arch User Repository) is a community-driven repository where anyone can submit build scripts (PKGBUILDs) for software. With over 85,000 packages, it has more software available than any distribution's official repository. However, AUR packages are not audited — installing them requires trusting the maintainer, and security incidents have occurred.
Nix can have multiple versions of the same package installed simultaneously¶
The Nix package manager (2003, Eelco Dolstra) stores each package version in a unique path based on a cryptographic hash of all its inputs: /nix/store/abc123-python-3.11.0/. This means Python 3.9 and Python 3.11 coexist without conflict. No other mainstream package manager achieves true side-by-side installation of different versions of the same package.
yum was replaced by dnf but kept as an alias¶
DNF (Dandified YUM) replaced Yum as Fedora's package manager in Fedora 22 (2015) and RHEL 8 (2019). DNF uses libsolv for faster dependency resolution and has a more predictable API. On RHEL 8+, typing yum actually runs dnf through a compatibility alias. Many administrators did not notice the transition because the command-line interface was deliberately kept similar.
Package signing prevents tampering — but most users cannot verify it¶
RPM and DEB packages are cryptographically signed with GPG keys. But the trust model is circular: you download the GPG key from the same server as the packages. If the server is compromised, both the key and the packages are controlled by the attacker. HTTPS for repositories mitigates this but was not universally adopted until the 2020s.
Alpine's apk is the fastest package manager on Linux¶
Alpine's apk (Alpine Package Keeper) can install hundreds of packages in seconds because it uses a simple tar+gzip format, performs all operations in a single transaction, and the packages themselves are tiny (musl libc, no locale data). This speed is a major reason Alpine became the default base image for Docker containers.
Homebrew runs on Linux now, not just macOS¶
Homebrew, created by Max Howell in 2009 for macOS, added official Linux support ("Linuxbrew") in 2019. On Linux, Homebrew installs packages to ~/.linuxbrew/ or /home/linuxbrew/.linuxbrew/ without requiring root access. This fills a niche for developers who want newer packages than their distribution provides but cannot use sudo.
The Debian NEW queue can take months¶
When a new package is submitted to Debian for the first time, it enters the "NEW" queue for manual review by the FTP team (a small group of volunteers). Reviews can take weeks to months due to the backlog. This thoroughness is why Debian's main archive is considered one of the most trustworthy software repositories, but it also means new software reaches Debian users much later than Ubuntu or Fedora users.