Package Monitor

Most of us spend a significant amount of time in front of our computers searching for information – whether in the browser via a search engine, in the filesystem with commands like find and locate, or with graphic tools. One of the commands most frequently used with us, whohas, determines which distributions have which version of a specific package in their archives. Using this command can be frustrating: whohas does not support all distributions, and not all distributions' repositories can be reached at the time of a query.

In a search for alternatives, I came across a genuine treasure chest, Repology [1], a web app that lists the software packages of many distributions. It retrieves this data hourly directly from the distributions' repositories. Repology links together a versatile set of information about the individual packages. At the time of writing, Repology covered more than 120 repositories with over 2.5 million packages.

Repology, which is implemented in Python, is maintained on GitHub [2]. Besides the archives of Linux distributions, Repology also integrates some BSD projects' data. In addition, Repology tracks the activities in repositories such as Deb Multimedia, RPM Fusion, Chocolatey, F-Droid, Homebrew, and many others.

In short, Repology acts as a search engine for packages in repositories of Linux distributions and beyond. Since it offers numerous evaluation options, it provides users with many insights and comparisons of individual packages. In this way, you can discover, for example, which distribution is best suited to your needs in terms of cutting edge software, the number of packages provided, or other criteria.

As an introduction, I will use Repology to quickly find out which distributions provide the latest version of Firefox. As background, web applications always need to be up-to-date because of constant new attack scenarios. Ideally, only one or two days should pass before a new or patched version of Firefox or any other web application becomes available in the package sources.

Useful Data

Repology's data is of interest to developers, package maintainers, and end users alike. While developers can discover which distributions offer their software, package maintainers can keep track of new versions of the applications they package and see at a glance which maintainers are packaging the same software for other distributions.

End users know when new software versions become available and can jog package maintainers' memory at their distribution of choice if needed. Apart from this, browsing in Repology is an extremely entertaining pastime.

Fox Hunt

Before getting started, you need to know that Repology refers to everything that has to do with a software application (Firefox in our case) as a project. When you open the web app, you'll find six tabs at the top of the page: Projects, Maintainers, Repositories, and Tools on the left and News and Docs on the right.

I'll start our search in the Projects tab where I'll enter firefox in the search bar. Clicking on Advanced lets you refine the search, for example, by searching in special repositories for the package or for Firefox packages by a specific maintainer. I'll just do a simple search and select Firefox (firefox*) from the displayed projects (Figure 1).

Figure 1: Repology views Firefox as a project, which includes all packages that have Firefox in their name. We are interested in the firefox* entry at the bottom, which stands for the web browser.

To the right of the project name in Figure 1, the Spr column (which stands for spread) indicates the number of repository families in which the project is found. For example, Debian Stable, Testing, Unstable, Oldstable, and Experimental count as one family. Clicking on firefox* will open a view of the repositories that provide Firefox (Figure 2).

Figure 2: The different Debian branches offer different versions of the web browser. Versions marked in red are outdated; Yellow indicates a legacy version that is still maintained for compatibility reasons.

Many Foxes

In the upper left corner, you can see how many Firefox packages Repology recognizes. These include Firefox, Firefox ESR, Firefox Developer, and all the other variants in all represented versions. Under the Category section, you can see where the package is categorized in a distribution. On the far right below Maintainer(s), you will find the package maintainer(s). Scroll down to the bottom of the page (a long way for the Firefox list, admittedly) to find the archives that currently do not offer Firefox packages.

Green Is the Color

In order to be able to assess whether information is up to date, you need to pay attention to the color codes. A chart explaining what each color means can be found at the bottom of each page or in the documentation [3]. If you are always looking for the latest versions, you want to watch out for the color green.

In Figure 1, Firefox 76.0.1 is green, but Firefox 76.0, which was released only four days earlier at the time of writing, is highlighted in red and therefore considered deprecated. The newest version is beta version 77.0b3, shown in turquoise.

Sometimes an outdated version will not appear in red. Instead, it will have a yellow legacy label, which means that this version is still available for compatibility reasons (Figure 3).

Figure 3: Using Python as an example, it is easy to see that the obsolete Python 2 version will be with us for a while longer for compatibility reasons in some distributions, while other distributions have already radically removed it.

Deeper and Deeper

In addition to the versions currently available through the distributions, you can also select Packages, Information, History, CVEs, Related, Badges, and Report in the buttonbar at the top. Each provides a different view of the information for a given package.

Clicking on Packages opens up a wealth of additional information on the various Firefox packages per version and distribution, allowing comparisons between the packages of different distributions (Figure 4).

Figure 4: Clicking on Packages provides detailed information about the Firefox versions in a distribution. This ranges from information about the website and package maintainer to links to the build script.

If there is an official maintainer for a package, clicking on their email address reveals the other distributions for which they maintain this package. Package related links takes you to more information, such as the GitHub site, package information on dependencies and licenses, or which maintainer signed the package.

Unlike the Versions and Packages buttons, which focus on the package, Information lists data from all packages and groups it by type (e.g., versions of all known packages, summaries of all known packages, or links for all known packages).

Who's Been Busy?

The still experimental History button chronologically lists all actions related to Firefox (Figure 5). This view, like some others, can be set to Enable autorefresh, which causes the page to automatically refresh the content.

Figure 5: History provides chronological information with hourly updates on changes to the package under review across all monitored repositories.

Related lists connections from Firefox to other projects. The tool identifies related projects by recursively matching URLs on the package homepage.

Badges includes code snippets used to create badges that summon up information from Repology to be included on other websites as a badge. Badges come in different formats, determined by the code snippets.

Report lets you report problems in regards to how a project is displayed. Errors include the wrong latest version number, an unrelated entry that needs to be split into a new project, or entries for the same project with different names that need to be merged into a single project. Errors are virtually unavoidable with the abundance of cross-referenced information.

Who Maintains Firefox?

To find out who bundles Firefox for which distribution, click on Maintainers in the upper left corner. For a successful search, you need the maintainer's email address or nickname, which you should find in the Versions view with any luck.

I wanted to see what Mike Hommey, Mozilla developer and Debian package maintainer for Firefox, has been doing. After entering his Debian email address, clicking on the link opens the page showing Hommey's activities in terms of Firefox packaging. This includes information about distributions that use these Firefox packages, the number of packages, and how up-to-date they are. A click on the respective distributions to which Hommey delivers takes you directly to the distribution page within Repology with further general information (Figure 6).

Figure 6: The Maintainer view shows where packages by Firefox maintainer Mike Hommey are used.

Statistics and Graphs

The Repositories tab leaves the Firefox project and gives a general overview of Repology divided into the subcategories Statistics, Packages, Graphs, Updates, and Fields.

Statistics displays information about the number of packages, how up-to-date they are, and the number of maintainers, broken down by distribution and their last releases. At the time of publication, Repology is aware of 190,374 projects with a total of 2,507,760 individual packages.

Packages provides details about packages in each distribution. The abbreviations above the columns are defined as soon as you mouse over them.

Graphs evaluates the information in graphs, while Updates shows when a distribution last updated the packages (Figure 7). In Fields, Repology reveals what information the distributions provide for their packages. This ranges from a summary of the software and its maintainer to the website and license.

Figure 7: Updates shows when activity in each repository last took place. Among other things, both successful and failed build processes are displayed.

Additional Information

The Tools tab provides additional tools. Project by package lets you generate a link to Repology project pages and badges. Trending and declining projects shows projects that have been added or deleted in the past month. This tool is practical if you are looking for interesting projects that are just starting to take off.

Conclusions

If you are interested in more than just using Linux and want to look beyond the scope of your distribution of choice, Repology offers a cornucopia of current package information. All of this information is interlinked, making it easy to search or just to have a quick look at the huge database. For more information on how Repology collects this data, check out Repology's ruleset on GitHub [4].