Hosting a Repository

You do not have to use the store. A repository is a JSON catalogue and the .deb files it points at, served over HTTPS from anywhere.

The catalogue

{
  "name": "My Repository",
  "serial": 1,
  "packages": [
    {
      "packageID": "com.example.mytweak",
      "name": "MyTweak",
      "version": "1.0.0",
      "author": "Your Name",
      "description": "What it does.",
      "downloadURL": "debs/com.example.mytweak/1.0.0.deb",
      "sha256": "..."
    }
  ]
}

downloadURL is relative to the catalogue, so the repository can move to another host without every entry being rewritten. Absolute URLs work but pin you to the origin you published from.

Checksums

sha256 is checked against the downloaded file before anything is unpacked, and the install is abandoned if it does not match. Publish it for every package.

A checksum proves a download matches what the catalogue claims. It proves nothing about where the catalogue came from, which is what signing is for, and third-party repositories are not signed.

What users see

A repository added by hand is marked as such. TweakInject does not review what it publishes and its tweaks carry no approval from the store. Users are told this plainly, which is the honest trade for being able to publish without asking anyone.

Serial numbers

Increment serial on every publish. Clients refuse a catalogue older than the newest they have already accepted, which is what stops someone serving an old one to bring back a package you pulled.