8

I normally tend to use the PPAs (Personal Package Archives) found in launchpad.net, but I have noticed more and more that some repositories are being created in other places or a website that manages packages in a similar fashion like launchpad.

So my questions are:

  • What is an official repository and an unofficial one (Local Repository), including the ones created outside of Launchpad.

  • How do repositories created outside of Launchpad compare to the ones found inside of it in terms of first, security, followed by any other features that both offer.

  • How do official software repositories differ from the ones created by 3rd party PPAs in Launchpad or outside of it.

Improve this question
1
  • You mentioned creating repositories on Dropbox. DropBox users cannot create an APT repository on dropbox.com because of limitations on how externally accessible URL's pointing to user content are named. The dl.dropbox.com repository is Dropbox's own repository, which provides the Dropbox software.
    – Eliah Kagan
    Mar 28, 2013 at 16:59

2 Answers 2

Reset to default
6

If you boil this back to the simplest terms:

What is an official repository and an unofficial one (Local Repository), including the ones created outside of Launchpad.

An official repository is one published as part of Ubuntu, managed by Canonical and Ubuntu MOTUs.

They currently consist of main, restricted, universe, multiverse, partner, extras and some exist in multiple "states" (-proposed, -updates, -backports, etc).

The repo names might change in time but the point is that these are .

On mirrors: The contents (MD5 hashes of files, etc) of the repository are signed with the Ubuntu key so even if you're pulling the official files from a non-official mirror, you can be fairly certain that they are the original files.

How do repositories created outside of Launchpad compare to the ones found inside of it in terms of first, security, followed by any other features that both offer.

You can't implicitly compare security levels between a Launchpad PPA and another non-official repo hosted elsewhere. It all boils down to how much you trust the person running the repo.

The difference is with a Launchpad PPA, you can see the person who is packaging things. Most times you can see the source. In other repos (eg: dl.google.com or repo.steampowered.com) you likely know neither.

Trust is an odd thing.

Feature-wise a repo is just a particular structure of directories and files, hosted on the web. The only special features I've ever seen are authentication to allow only people who have purchased software to download it but this very basic web server security and hardly special :)

How do official software repositories differ from the ones created by 3rd party PPAs in Launchpad or outside of it.

This is perhaps the biggest of the questions and it's probably best answered (if indirectly) by another question: How to get my software into Ubuntu?

Official repo software is supposed to have a development process behind it. Levels of testing that ensure quality and an amount of peer review. PPA maintainers can encourage this sort of process but it's not something you can assume. Some are better than others.

Improve this answer
0

Only archive.ubuntu.com and security.ubuntu.com (and its mirrors) are offical repositories. Anything else, including PPA is not. Every PPA and 3rd party repo is different, you can't compare them in general. e.g. I have 2 PPA's: one that provides things that Ubuntu doesn't, and one with packages where I make different packaging decisions than Ubuntu. Not comparable :)

Improve this answer
5
  • This is incorrect (though it could be edited to be correct). Official mirrors are official too, for example, us.archive.ubuntu.com, gb.archive.ubuntu.com, and so forth. Most people don't actually use archive.ubuntu.com because it is so slow, and Ubuntu automatically configures a system to use a regional mirror as part of installation (typically without even consulting the user, or mentioning that it is doing so).
    – Eliah Kagan
    Mar 28, 2013 at 16:58
  • And non-official mirrors are still official too. All the packages and lists are signed. It doesn't matter where you get things but they won't readily install if they don't match their signatures.
    – Oli ♦
    Mar 28, 2013 at 17:04
  • You've added the text "(and its mirrors)" but that doesn't explain it to anyone who doesn't already understand it. An good answer to this question should explain how to figure out if something is an Ubuntu mirror...or at least explain how to recognize the most commonly named official Ubuntu mirrors.
    – Eliah Kagan
    Mar 28, 2013 at 17:19
  • I'd add that if it would add value to the person asking the question. But he already demonstrates a good working knowledge of how repositories work, so it would be superfluous.
    – Dennis Kaarsemaker
    Mar 28, 2013 at 17:25
  • 1
    @DennisKaarsemaker Questions are not just for the one person who asked them. That's why answers are publicly viewable! So even if Luis Alvarado had not deliberately asked this for the benefit of others, answers should be clearly explained. But Luis Alvarado in fact did ask this for the benefit of others--see this chat room (which Luis Alvarado was present in while the discussion took place) and this message where he told me he asked this.
    – Eliah Kagan
    Mar 28, 2013 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .