Distribute Packages Using Folder-Based Repositories

A MATLAB^® package repository is a place where packages are stored and distributed. Packages that are ready for distribution can be added to a repository, and end users can search for and install packages from the repository. MATLAB keeps a list of known repositories. When you search for a package using mpmsearch or install a package using mpminstall, the MATLAB Package Manager finds packages in known repositories.

Designate Folder As Repository

You can make a folder into a repository by using the mpmAddRepository function. For example, add the C:\MyCode\MyRepository folder to the MATLAB repository list and name it "MyRepo".

repo = mpmAddRepository("MyRepo","C:\MyCode\MyRepository")

repo = 

  Repository with properties:

        Name: "MyRepo"
    Location: "C:\MyCode\MyRepository"

By default, the function adds repositories to the end of the MATLAB repository list. You can add a repository to the top or the bottom of the list using the optional Position name-value argument. For example, add the repository to the beginning of the list.

repo = mpmAddRepository("MyRepo","C:\MyCode\MyRepository",Position="begin")

When the MATLAB Package Manager searches for or installs packages, it checks repositories in order from the beginning of the list to the end. If the MATLAB Package Manager finds a package that meets the requirements in a repository, then no further repositories are checked. For additional information, see Package Resolution During Installation.

Share Packages Using Repositories

You can make a package available to others by adding it to a repository. Add a package to a folder-based repository by creating a copy of the package root folder and its contents and placing the copy in the repository folder.

For example, create a copy of the package root folder MyPackage@1.0.0 and add it to the repository located at C:\MyCode\MyRepository.

copyfile("MyPackage@1.0.0","C:\MyCode\MyRepository\MyPackage@1.0.0") 

Once the package has been added to a repository, end users who have added the repository to their repository list can search for and install the package.

mpminstall("MyPackage")

For more information about searching for and installing packages, see Find and Install Packages.

Display List of Known Repositories

You can display the list of known repositories by using the mpmListRepositories function.

mpmListRepositories

         Name                    Location            
    _____________    _______________________________

    "MyRepo"         "C:\MyCode\MyRepository"
    "SharedRepo"     "M:\SharedCode\PkgRepo"       
    "DepartmentRepo" "Z:\Astro\PackageRepo"

Remove Repository from List

You can remove a repository from the repository list by using the mpmRemoveRepository function. For example, remove the repository located at C:\MyCode\MyRepository from the repository list.

mpmRemoveRepository("C:\MyCode\MyRepository")

Now display the repository list.

mpmListRepositories

        Name                    Location            
    _____________    _______________________________

    "SharedRepo"     "M:\SharedCode\SharedRepository"       
    "DepartmentRepo" "Z:\Astro\PackageRepo"

Security Considerations for Shared Repositories

When a repository is accessible by many people, it is recommended that only a limited set of authorized users or administrators be allowed to modify the contents of the repository folder. This precaution helps to mitigate the risk of malicious tampering with its packages. This restriction can be managed through file system permissions.

Additionally, you can provide package checksums to end users of the repository to help detect package tampering. Use digest to compute the SHA-256 digests of the packages in the repository, and distribute those digests to end users alongside the packages or through some other secure distribution channel, such as a secure website.

pkg = mpmlist("MyPackage");
SHA = digest(pkg)

SHA = 

    "ab0863fa6a1eeb0fade092abd583323bee73d1dd5ce4a74aa031e4995ae2bb79"

When installing a package, use mpminstall with the option Verbosity="detailed". mpminstall recomputes and displays the current digest value for each installed package.

mpminstall("MyPackage",Verbosity="detailed")

The following packages will be installed:
    MyPackage@1.0.0  (digest: ab0863fa6a1eeb0fade092abd583323bee73d1dd5ce4a74aa031e4995ae2bb79)

Do you want to continue? [YES/no]:

If this value does not match the originally computed digest value, the package has been altered. Cancel the installation by responding no at the Do you want to continue? prompt. Report any discrepancies to the administrator of the shared repository.

Finally, it is recommended that a secure backup be maintained of the files in the repository, so you can restore of the original files if tampering is detected.