Slashdot Mirror
The Future of Packaging Software in Linux
michuk writes "There are currently at least five popular ways of installing software in GNU/Linux. None of them are widely accepted throughout the popular distributions. This situation is not a problem for experienced users — they can make decisions for themselves. However, for a newcomer in the GNU/Linux world, installing new software is always pretty confusing. The article tries to sum up some of the recent efforts to fix this problem and examine the possible future of packaging software in GNU/Linux."
Seriously, drag-n-drop installation rocks.
Cemil.
Fat binary; all dependencies complied into it.
And that is ... define the requirements that the next generation package manager should have.
That way there is no need to worry about "replacing" the existing systems. You can instead focus on evolving them to meet the requirements. Even if each distribution/project takes its own path to get there.
#1. It must make installing new software as easy as it currently is with apt.
#2. The same for upgrading the software.
#3. The same for removing the software.
#4. The same for handling dependencies. Including the order in which dependencies must be installed.
#5. The same for validating the installed software against the original software (checksums or whatever).
#6. The same for re-installing the software over the existing installation when you accidentally delete or over-write something.
#7. The ability to point the updater at your own repository or multiple repositories.
#8. The ability to recompile (automatically) any software that you install for your specific hardware.
Anything else? Yeah, I know most of this is already handled with apt. But that's what I'm most familiar with. I keep seeing all the articles about "problems" but I don't seem to run into any problems on my server or workstations (and I'm running Feisty Fawn on my workstation).
The hard part, as I see it, is dependency management for upgrading software.
Eventually, with RPMs, for example, I end up getting to the point that I have to force something, which shouldn't ever really have to happen... but it does.
500GB of disk, 5TB of transfer, $5.95/mo
The problem is not that everyone is willing to accept a solution that sucks, the problem is that the current solution of integrated package management rocks.
All I need to do is search for something in the package manager GUI, click the its checkbox, click "apply", and I'm done. It's even easier than downloading a dmg, because you've got to go out and find that dmg on the publisher's website, or versiontracker or whatever. I simply express a desire for that program to be available, and then downloads, installations, updates, etc are all handled by the package manager. This even works for proprietary software (eg I have Nvidia's binary drivers, Adobe's Flash and PDF reader, VMWare Player, etc installed through my distro's package manager).
The best solution is for the vendor to supply whatever they're going to supply in a tarball, and then let the maintainers figure out what the dependencies and so forth are.
I rarely criticize things I don't care about.
You may want to read this excellent essay, entitled Linux is not Windows. I think it will offer you some valuable perspective on the issues you're addressing.
Absolutely right, never mind the inconsistencies as they don't affect the normal user.
For example, all my wife needs to know is: open Synaptic when she needs some software. Or even (gosh, how difficult) look for software on the Internet, open Synaptic and type the name in.
I believe the article is missing/trying to say that regardless of the package method used CNR will provide a wrapper for all of them. So the solution is not to create yet another method (that will never work), but embrace all the existing ones in an easy-to-use interface.
That interface will be provided in both Freespire and Ubuntu Feisty. It should be good for newbies, hardcore Linux people will hate it (although that doesn't matter: it's not aimed at them).
A great idea??? Are you serious?
Choice is good - until the point where it becomes totally overwhelming. On linux there are dozens of distros to chose from (different versions of the said distros too - running on different versions of the kernel), different window managers to chose from, different installers (apt get or whatever, applies to both the command line and the graphical installers), different package formats, different shells, too many different text editors (vi/emacs/...) and such.
Most users appreciate SOME choice. Like when you go to the dealership, you pick the car model, the engine, color and such. The linux way, you'd be forced to hand pick things like the actual metal alloy used for the pistons' segments and such intricate things most people couldn't care less about. Yes, you could have a totally custom car, but it would take 6 months to pick all the parts by hand, and comparing the cars to another would be so complicated and overwhelming...
Too many confusing choices to make, often over stuff one doesn't really understand. And when searching for information about them (to make the choice), often all one finds is heated debates (like kde/gnome or emacs/vi) without much real information.
When I use my PC at home, at work, on the road, at friends or relatives' places, it's always the same interface (plain old WinXP), same way to do things, stuff located in the same places, most apps are the same, etc. Predictable, consistent and simple. Most people truly appreciate that.
If we were all running linux, I'd be using say, KDE or gnome, work might be using fluxbox, a friend would use something like xfce... All on different distros that work differently and have different apps installed by default (likely not the ones you're used to). I'd be lost.
The real bastard is that each distro has subtle differences in how the packages and the dependencies are organized. The only way that I can see to fix that is to design a universal package tree, and convince all the major distros to conform to it. Which is not impossible, but it aint easy, either. And it might cause other problems.
Which is why, as it currently stands, this year will not be Year Of The Linux Desktop. Consumers won't just accept that they can't install software X because it's an RPM and alien doesn't work (this is of course after looking online for half an hour to figure out that alien is the tool to use). Manually compiling from source is simply not an option for standard users. Sure it's a dandy idea, and if you get a "fullproof" GUI that handles the compilation and installation then maybe, but I can't count the number of times make/make install has failed for some obscure reason. The first time grandma needs to go download dependencies means Linux has failed on the consumer desktop.
This is one place that Microsoft and Apple have it right. By having a standardized method of installing and storing program information they make getting new software many times easier than on Linux (excluding the "normal" packages. I'm thinking more along the lines of tools and apps you download from the web). This is also one reason people are willing to pay for an operating system that has a standardized and dependable way of doing things.
Microsoft even released the WiX toolkit that allows anyone to create MSI installer packages. MSIs are one of the best ideas for Windows in a while: No more dealing with poorly-written homebrew installers or 10-year old, 16-bit InstallShield programs. Instead you have a fully scriptable installer that's transaction-based and has near 100% support coverage.
I like apt, but downloading a gzipped file of source or a deb that complains about dependencies still can't compare to an MSI package. Even if a solution was developed that worked as well as or better than MSI, as you say, it would take significant effort (and maybe not even then) to get it supported by all the major distributions. Some people seem to think that the fact that Debian does things differently from Mandriva that does it different than Fedora is what makes the distribution "special". Be that as it may, I think it's only hurting Linux users as a whole.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
WiX is fully open source, so if you wanted, you should be able to figure out how to create MSIs from that. In any case, you could try running it under Mono, maybe it'll work under Linux...
Most of those EXEs are actually MSIs wrapped with a stub installer that can install the Windows Installer if it's missing.
Well..... yes. It is. Sort of. It allows arbitrary binary code to be run - but then again, it's an installer. It could run arbitrary code anyway. Complaining that MSI is "another executable format" would be like complaining that RPM is "another executable format" - it's equally true. (Although I think RPM generally runs shell scripts, not direct binary code. Although I could be wrong.)
Right, nobody does that because it's practically impossible to get it working. Instead they discover that it's not in the apt repository and give up. That's the problem with the Linux packaging system - if it's not there already, it's basically impossible to install unless you're a Linux expert. Now you might say that "any software you'd ever need" is going to be available, but you're guaranteed to be wrong at some point. Some new game, some new app, something will become available that someone will want to install - and won't be able to, because it's not in the distribution repository.
Worse, from the developer point of view, they might create some great new software that they want to release in an easy to install form - and, really, can't. Maybe they'll generate an RPM or a DEB for their own installed Linux distro, but beyond that, it's just too much effort to try and make an installer for everyone.
Oh, and MSI is horrendously overcomplicated compared to RPM and DEB, in case you wanted to know. Nothing like having to generate a GUID for every single file you might want to install. (Although to be fair, that's likely because most Windows programs don't contain all too many files.)
You are in a maze of twisty little relative jumps, all alike.
Boy do I disagree with this statement.
If you make it too easy to run such that no OS is responsible for the software that is installed from anywhere on the internet. What's the difference from this and malware that runs rampant on Windows -- where it is pretty painless to install anything from anywhere.
Ok, so the binary package capability of Gentoo may not be completely unused, but it is used sparsely, if that. A very few select programs have binary equivalents (OpenOffice, Firefox, and Azureus come to mind), but what I think the GP is looking for is a way to specify "all binary, all the time" as a build option. I'm certainly looking for that. Combine that option with the newly-introduced graphical installer, and voila! Gentoo can be used as a Grandma System, too.
/etc/portage/package.keywords.
What the Gentoo devs need to do is to add arches like x86-bin, amd64-bin, etc. to the Portage tree, and these arches would not compile anything--just install binary packages. Every time this is brought up, many Gentoo devs jump to the defense of building from scratch, saying "if you don't want to build from scratch, what the hell are you doing using Gentoo?" And I usually respond with something along the lines of "but isn't Gentoo all about choice? And shouldn't I have the choice to install binary packages?"
The binary packages would be standardized on a certain set of USE variables, and only compiled for each arch/CHOST combination (to reduce storage costs at the repositories). If someone needs a specific set of USE variables for a particular package, they can build from source by specifying a non-binary arch in their
The beauty of Gentoo is scalability; the system can be tailored to be anything you want it to be. This will add one more option: Gentoo can also be a binary distro, suitable for non-hardcore users. If Debian can do it, why can't Gentoo?
For security, the MD5 hash of this message and sig is 09f911029d74e35bd84156c5635688c0.