Post #787354

2026-03-21 13:21 UTC

A repository or repo is a server that hosts program files for your distribution. Distributions host their own repositories from which you can install software with your package manager, like APT or DNF or others. If you only install software from your distribution’s repository, there’s likely no clashes with software versioning and dependencies, and the packages are about as reliable as they can be (which doesn’t mean there’s never malware). If you add third party repositories for software not available from your distributions repository, it’s more likely there will be issues, because the distribution doesn’t guarantee the packages work well together. For example, Debian and Arch don’t retrieve and install their software from the same source. They have their own servers (repositories) hosting software compiled to work with their particular distro and to be used by their chosen package manager. Flatpak (or Snap or Guix) is a separate package manager that handles it’s own dependencies and doesn’t clash with your distribution’s own software manager. Does this help?

Replies (1)

@Cekan14@lemmy.org 2026-03-21 14:40

Hi! Thank you for your reply. So, if I understood correctly, whenever I click on “Install from Debian/GNU Linux” on Discover I am getting software directly from Debian’s repository (thus, a “repository” in the sense that it’s a place where this software is stored and can be retrieved); same thing when clicking on “Install from Flathub” for a Flatpak from Flathub. This does seem like the safest approach in the sense that it’s the less risky one and, if malware did slip through, such as the XZ backdoor, at least it would not have been due to a personal mistake of mine, but a general one which would’ve affected much more people too. This, in turn, is different from APT, which is not Debian’s repository, but Debian’s package manager. So, technically, I could write “sudo apt install (anything)” to get any piece of software from Debian’s repository indeed, but I could also use that command to get software from somewhere else also in the form of a Deb package but which would not have come from Debian itself. Did I get this right? Thanks a bunch.

Open ##1501751