# Package Manager A package manager discovers, resolves, verifies, installs, updates, and removes software packages and their dependencies. ## Security authority Package managers sit at a high-leverage supply-chain boundary. Repository configuration, package identity, signatures, dependency resolution, maintainer credentials, install scripts, mirrors, and update policy determine what code enters a system and with what privilege. ## Evidentiary boundary An installed package proves software state, not authorization or malicious intent. Relevant evidence includes repository origin, version, signature, transaction history, scripts, hashes, and dependency graph. ## Relationships [[PackageKit]] · [[Software Bill of Materials]] · [[Software Supply-Chain Provenance]] · [[Homebrew]] · [[F-Droid]].