LPMtool includes the tools necessary to create new packages and publish them on a web-based package repository. LPMtool makes good use of features offered by HTTP 1.1. Checking for updated packages is very quick, and efficient. LPMtool web repositories use resource index files. If LPMtool is looking for a package that supplies a particular resource, but doesn't know which package provides it, LPMtool does not need to download the metadata of every package in the repository.

LPMtool uses caching. A LPMtool package repository specifies how often the repository should be checked for updates. This setting can be individually set for each repository. LPMtool caches package repository metadata, and automatically resynchronizes with the main repository according to this refresh interval setting. Between refreshes LPMtool will use the local repository metadata cache to resolve queries quickly.

All packages published on web repositories must have a valid GPG signature. A separate keyring is maintained for every LPMtool repository, and LPMtool will accept packages only if they are signed by one of its repository's keys. Every file on a web repository, not just the binary packages themselves, must carry a valid GPG signature. Even the package metadata indexes must be signed.