Package Manager

Software rarely consists of a single piece. Mostly it builds on ready-made components that other people have written. Such components are called packages: small, named collections of program code with a version number. A package manager is a program that fetches, installs, updates, and deletes these packages for you. It also knows which package needs further packages, and fetches those along with it. Without such a tool, you would have to download each part individually from a website and copy it by hand to the right location.

Why nobody copies components by hand anymore

A modern project quickly depends on hundreds of packages. Most of these the developer never consciously chose. They come along as add-ons: package A needs package B, package B needs package C. This chain is called dependencies. Managing them by hand would be practically impossible.

On top of that comes the problem of versions. Programs change, and a new version of a component can behave differently than the old one. A package manager therefore notes precisely which version was installed. This means the same project runs the same way on a colleague’s machine as on yours. This repeatability is the actual reason such tools exist.

The third point is security. If a vulnerability is discovered in a widely used component, it has to be fixed everywhere. Through the package manager, a single command is often enough for this. Without it, hardly anyone would know which version is even running on their machine.

Registry, dependency tree, and lock file

Central to this is a kind of catalog on the internet, usually called a registry. It holds the packages along with all their versions. The package manager queries it, downloads the files, and places them in a fixed directory. Along the way, it checks via a checksum whether the file was altered in transit.

The tricky part is resolving the dependencies. Two packages sometimes require different versions of the same third package. The package manager then has to find a combination that satisfies all conditions. You can picture this like a class schedule in which no two subjects are allowed to overlap. If it can’t find a solution, it aborts with a conflict error.

It writes the result to a lock file. In it, the exact chosen version is recorded for every single package. Next time, nothing is recalculated — instead, exactly this list is installed. This way, everyone involved ends up with the same state, even months later.

From apt on a Linux machine to pip in the world of AI

On Linux systems, apt or dnf manage the entire operating system at once. For the programming language JavaScript, npm is common; for Python, pip or conda. Even your phone’s app store works at its core like a package manager, just with a nicer interface and a payment feature.

The topic becomes especially visible in AI development. Anyone who wants to run a model themselves typically installs libraries like PyTorch using pip. If the version doesn’t match the graphics card or some other component, nothing works at all. Such version conflicts are among the most common startup problems there are.

In the news, package managers usually turn up in connection with attacks. Criminals upload malicious code under a name that looks deceptively similar to a popular package. Anyone who mistypes ends up installing the fake along with it. This is called an attack on the software supply chain. A common misconception, by the way, is that a package manager merely saves storage space. Its main purpose is order, not size.