What the package server is
This page is for anyone who installs Exponential and wants to know what the installer talks to on the internet. It answers: what the package server does, what it does not do, which parts of Exponential use it, and which requests they send.
Contents
- Its job
- What it is not
- Who reads from it
- The requests, step by step
- How it answers
- Why a static site
- Related pages
Its job
The package server publishes the site installer packages of each Exponential release: the .ezpkg archives a
new installation is built from, and one index.xml per release that lists them. The default server is
https://exponential.packages.exponential.earth/.
The description of its repository on GitHub puts its role plainly: "This server is tied to the individual Exponential 6 Setup Wizard Installation Configuration Process used only once to install the software as designed. Users do not need to use this server outside the setup wizard usage."
So an installation reads from the server while it is being installed, and afterwards only when an administrator asks for another package (for example through ezupdate's package servers).
What it is not
| It is not ... | Because ... |
|---|---|
| an application | it is a static HTTPS site published by GitHub Pages; nothing on it runs code |
| an account system | there is no sign-in, no API key, no upload form; everyone gets the same files |
| a Composer repository | Composer packages (extensions, the kernel) come from Packagist; the package server only holds .ezpkg files |
| a place for updates of a running site | an installed site does not check it; updating code is done with Git or Composer (Update with Git) |
| the only source of packages | the installer also uses packages already in var/storage/packages/ and accepts an uploaded .ezpkg |
Who reads from it
| Part of Exponential | When | Code |
|---|---|---|
| The setup wizard, step Site package | when the step is shown and when a package is chosen | kernel/setup/steps/ezstep_site_types.php |
The kickstarter (exp:kickstarter run) | in the SiteTypes step, for [site_types] Site_package of kickstart.ini | the same step class, in kickstart mode |
The console install (exp:install --package=<name>) | the same step, driven from the command line | the same step class |
| ezupdate, Package servers | when an administrator lists a server's packages or fetches one | extension/ezupdate/classes/ezupdatepackageservers.php (in the ezupdate extension) |
All of them use the same address, settings/package.ini [RepositorySettings] RemotePackagesIndexURL
(Package server settings). ezupdate lists that server first, read only, next to
servers you add yourself.
The requests, step by step
For the setup wizard, eZStepSiteTypes does this:
It builds the index address:
RemotePackagesIndexURLplus/index.xml. For 6.0.15:https://exponential.packages.exponential.earth/exponential/6.0/6.0.15/index.xmlIt downloads that file into the cache directory (
<cache>/packages/index.xml), parses it and keeps every<package>element. For the list on the screen it keeps only those withtype="site".When you choose a site package that is not imported yet, it downloads the package's
urland imports it intovar/storage/packages/7x/<name>/.It reads the imported package's
<dependencies><requires>and, for every required package that is missing or older than itsmin-version, looks up itsurlin the same index and downloads it too.
Every download is a plain GET. With the PHP curl extension, site.ini [ProxySettings] ProxyServer (and User,
Password) is used when set; redirects are followed (at most five). See
the index.xml format for the file and
How the setup wizard uses packages for the whole step.
How it answers
Checked on the live server:
| Request | Answer |
|---|---|
GET /exponential/6.0/6.0.15/index.xml | 200, Content-Type: application/xml |
GET /exponential/6.0/6.0.15/sevenx_multisite.ezpkg | 200, Content-Type: application/octet-stream, with Content-Length, Last-Modified and ETag |
| any of these files | Cache-Control: max-age=600 |
a folder, such as /exponential/6.0/6.0.15/ | 200, a generated directory listing page (Browsing the package server) |
http:// instead of https:// | 301 to the HTTPS address |
| a release folder that does not exist | 404 |
Note
max-age=600 means a file that was just republished can be served from a cache for up to ten minutes. A fixed
package may therefore take a few minutes to reach every installer.
Why a static site
- Nothing to break in. There is no server code, database or upload; the attack surface is the files.
- Anyone can check it. Every file on the server is in a public Git repository with its full history (The package server on GitHub).
- Anyone can copy it. A release folder is just files. Copy it to any web server or to disk and point
RemotePackagesIndexURLat the copy (Offline installs and mirrors). - Contributions are pull requests. A new package reaches every installation by being merged into the repository (Contribute your site package).
Related pages
- Site packages: start here
- The package server
- What is on the package server
- Package server settings
- What a site installer package is
- Package servers in ezupdate
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.