Dev:Repository Management

Here are instructions and advice for setting up and managing a Cydia repository. For context, Cydia uses an adapted version of Debian APT (Advanced Packaging Tool) to manage packages.

If you have no interest in using your own server, you can use MyRepoSpace, which provides free repository hosting. It's often slow and unreliable though, and it gives you limited flexibility.

saurik's explanation
The authoritative guide to setting up a Cydia APT repository is saurik's post on the subject.

Share API
Public since July 3rd 2015 in saurik's tweet, it is possible to link to a repository or package from a url that Cydia can pick up.

To link to a repository, make an anchor on your site to

cydia://url/https://cydia.saurik.com/api/share#?source=http://apt.saurik.com/beta/itsamystery/

To link to a package, make an anchor on your site to

cydia://url/https://cydia.saurik.com/api/share#?source=http://apt.saurik.com/beta/itsamystery/&package=com.saurik.mystery

Replacing http://apt.saurik.com/beta/itsamystery/ and com.saurik.mystery to the target repository and package.

If the repository is not on the list Cydia will ask to add it. It will then take you to the package list (if linked to a repository) or to the specified package (if linked to a package).

Other explanations
Patrick Muff wrote "Create your own Cydia Repository on Ubuntu in a few minutes"

WinneonSword made a Tutorial Repository on Github.

Quick and dirty summary
First thing is, you'll need a web host. It could be anything, like Neocities or GitHub pages.

Repository structure
The basic idea is that you have two files in your server, Packages and Release. Packages must be bzipped and named Packages.bz2, and optionally Release may be also. Packages contains all of the information related to the different packages on your server (and where to download them, more on that later) and Release contains all of the information related to your server (like the name, description, etc).

If you want to see examples of Packages and Release</tt> files, you can see the cached files from your installed repos at /var/lib/apt/lists</tt> (note they can be quite large).

.deb files
The Packages</tt> file mentioned earlier points to .deb files in your server that you can download. These are made with dpkg-deb. Manpage here. The idea is that you set up a folder in the way you'd want the files to appear in your filesystem (and the DEBIAN</tt> folder, which would contain your control</tt> file, and optional preinst</tt> and postinst</tt> scripts) when it installs in Cydia, and then you'd use dpkg-deb -b folder_name</tt> to make the package (which will be named folder_name.deb</tt>).

Read more in the Packaging page.

Custom icon
Put the file CydiaIcon.png</tt> at the root of your repository. It is displayed at 32x32, and it would be best for the file to be at Retina resolution (64x64 for @2x and 96x96 for @3x).

Private repositories
NOTE: Static webhosts (like Github Pages) won't work for private repos. You'll need a server that has some way to let you process requests server-side, e.g. PHP, node.js, or Django.

UDID Protection
The easiest way to make your repository "private" is to restrict access based on UDID. Cydia sends the user's UDID via the X-Unique-ID</tt> HTTP header, so your server could check that against a database in order to ensure that the user has rightful access.

PHP implementation: A sample UDID-protected Cydia repo by moeseth.

Node.js implementation: A sample Node UDID-protected Cydia repo by Aehmlo.

Pitfalls of UDID Protection
UDID-protected repos are not very secure. UDID's can be easily faked since there is nothing to say whether it's legitimate or spoofed since it's sent as an HTTP header, and these are sent with every Cydia support email. There have been public UDID leaks that pirate repositories are known to brute-force packages with. An unfortunate number of repositories, and Cydia Store, use it despite its misuse being bad enough that it was banned from the App Store in 2012. You should not consider protection by UDID completely secure; while it works and is simple to implement, it's like a fingerprint: if it's compromised by bad guys, it's hard to change it.

Password Protection
You can use a username and password system through Cydia's depiction system, where the user enters their username and password in the depiction page, and then is authorized to download the package.

PHP implementation: A sample password-protected repo by goeo-.