Linux Security Blog

Linux package managers are a very interesting mechanism. For one thing, the package manager is the main thing that distinguishes one family of Linux distros from another. Things like the desktop environment, the window manager, what programs are installed by default, etc. are all malleable and don’t distinguish a distro beyond just it’s initial configuration, but the package manager is unique to each family.

Another thing that makes a package manager interesting is that it relies on a complex and intricate toolchain of back-ends and front-ends. This toolchain is what I will be examining here. We’re going to take a look at what actually happens when you install a package using a package manager like apt, pacman, yum, etc.

First, we need to establish the difference between source-based and binary-based package managers. These are the two main variations of package management used by Linux distros. As the…