Hosting a Repository

You do not have to use the store. A repository is a JSON catalogue and the .deb files it points at, served over HTTPS from anywhere.

The catalogue

{
  "name": "My Repository",
  "serial": 1,
  "packages": [
    {
      "packageID": "com.example.mytweak",
      "name": "MyTweak",
      "version": "1.0.0",
      "author": "Your Name",
      "description": "What it does.",
      "downloadURL": "https://example.com/tweaks/debs/com.example.mytweak/1.0.0.deb",
      "sha256": "..."
    }
  ]
}

Use a full URL. It is unambiguous, and it is what you want if the files are on a CDN or a different host from the catalogue.

Relative URLs

A relative downloadURL also works, and is resolved against the address of Packages.json itself, the same way a link in a web page is resolved against the page it sits in.

If your catalogue is at https://example.com/repo/Packages.json:

So ../ is how you reach a folder above the catalogue, and a leading / goes to the root of the host, ignoring where the catalogue sits. If any of that feels like arithmetic, use a full URL.

Checksums

sha256 is checked against the downloaded file before anything is unpacked, and the install is abandoned if it does not match.

You can leave it out. Nothing is then verified, and a file that changed between publishing and downloading installs without complaint. Publish it.

The official TweakInject store does not allow the choice: a listing there with no checksum is refused at install, because a missing one is exactly what someone who could edit the listing would arrange.

A checksum proves a download matches what the catalogue claims. It proves nothing about where the catalogue came from, which is what signing is for, and third-party repositories are not signed.

What users see

A repository added by hand is marked as such. TweakInject does not review what it publishes and its tweaks carry no approval from the store, and users are told so plainly.

Serial numbers

Increment serial on every publish. Clients refuse a catalogue older than the newest they have already accepted, which is what stops someone serving an old one to bring back a package you pulled.