A Windows-Based Packaging Mechanism

FishWithAHammer writes "As part of my Google Summer of Code project, I'm working with WinLibre to develop a Debian-like software download system for free/open source software on the Windows platform. My reasoning is that open source software suffers from poor presentation. Most computer laymen, even those aware of open source software, often don't have any idea how to go about looking for it, but would use it if it were easier to access. What I have proposed is both a Debian-style packaging mechanism (capable of using Windows Installer MSIs or not, as the user wishes) and a software 'catalog' that takes the best aspects of Synaptic and Linspire's Click-N-Run system. Seamless, simple installation and removal of programs in as straightforward a way as apt-get (there will be a command-line tool as well). I'm posting to Slashdot to get the ideas of you lot who, while you may not be the target audience, can certainly provide insights that can be of value." Read on for more of this reader's ideas and questions.

There are areas that I'm personally not familiar with, and while I have done some research I would like the opinions of Slashdotters on some others. While at first I intend to set it up so that WinLibre (and I) run only one repository, I am curious as to how this sort of tool could be most useful to network administrators. Customizable repositories will be available; the code will be under the GPL, after all, so it'd be a little hard for them not to be available.

I'm also interested in the ideas of those who might be in a position to roll together packages. I intend to package a number of open-source language interpreters with the core software to allow special pre- and post-install scripts, as well as removal scripts. C#Script, Perl, and Python are definites, as is a Cygwin sh interpreter. We will have some program requirements — chief among them that no registry changes may be made by the program — but some of them, I fear, will require some flexibility; some programs really do require a way to edit the registry, for example, and I am considering offering some sort of tracked way to make registry changes so they can be rolled back on uninstallation of the program.

I'd love to hear what Slashdotters think of this. Think of it as a wishlist, but you don't get any damn ponies.

Ed Ropple (FishWithAHammer)"

Comments

Oh no

[Anonymous Coward]

C:\>apt-get install bsod

Re:Oh no

[Xogede]

Error: Package "bsod" already installed.

Re:Oh no

[Anonymous Coward]

Does this mean we can also do?

C:\>apt-get remove bsod

Re:Oh no

[dhasenan]

error: this will break the following dependencies:
    bsod: is required by win-desktop
    bsod: is required by win-gui
    bsod: is required by nt-kernel ...

Re:Oh no

[russ1337]

Does this mean we can also do?
C:\>apt-get remove bsod

C:\> Removal of BSOD requires the following dependencies to be uninstalled:
> Windows Operating System
> Explorer.exe
> Continue Y/N?

Re:Oh no

[tacgnol]

http://windows-get.sourceforge.net/ Maybe we can google these things?

It's the package selection process

[zedman]

That's great of course, but it's the community and a selection of packages with mutually consistent packaging metadata which make systems like Debian and their derivatives so popular. The packaging system itself is an enabling technology.

Re:It's the package selection process

[babbling]

Why are you kidding? That's actually a very good point, I think.

If GNU/Linux was the only operating system that had applications like Firefox, OpenOffice, VLC, and so on, I think it would be a much more attractive option than Windows is. Yet, we've ported some of our best applications to the proprietary Windows platform, and as a consequence of this there is less incentive for Windows users to become users of Free Software operating systems.

I'm not necessarily saying that these ports shouldn't take place, but I think we should be aware of the fact that porting a great application to Windows does lessen the incentive for Windows users to make the switch.

Re:It's the package selection process

[maxwell demon]

If the explicit goal of an application programmer was to move people to Linux, the ideal strategy would probably be as follows:

1. Port the application to Windows
2. Get people addicted to it (that's the hardest part).
3. Make sure that new developments are always available on Linux first (so that there's a real incentive to switch to Linux).
4. At some time, introduce Linux-only features.
5. After enough users have switched to Linux, drop Windows support.
6. ???
7. Profit!

(Sorry, the last two lines just had to come! :-))

Of course the problem with this plan is that starting from step 4 on, it's virtually impossible to do with FOSS: If you don't implement those features on Windows, likely someone else will do. And if you drop Windows support, probably someone else will take over (remember, as of step 2, it's a popular application).

Re:It's the package selection process

[Rakishi]

The biggest barrier to switching for many users is that they won't be able to use their old apps on the new OS. This solves that problem.

Re:It's the package selection process

[PinkyDead]

Sorry to burst your bubble, but I think Microsoft has already patented your process.

Re:It's the package selection process

[Anonymous Coward]

why do we have to push Linux on people? I'm a massive Linux fan, but I use windows as my main desktop mainly due to games but I use a lot of open source tools on my windows machine. main two being audacity and Firefox and if I was forced to use linux as my main desktop because I couldn't get these apps on windows frankly would annoy me as much as Microsoft does with there windows only programs.

That type of mentally will do more damage to the open source movement then anything else.

Re:It's the package selection process

[suv4x4]

If GNU/Linux was the only operating system that had applications like Firefox, OpenOffice, VLC, and so on, I think it would be a much more attractive option than Windows is. Yet, we've ported some of our best applications to the proprietary Windows platform, and as a consequence of this there is less incentive for Windows users to become users of Free Software operating systems.

"We've ported to Windows"? Who the heck are ya?

Firefox, based on the XUL platform, which from the very beginning was designed to be multi-platform.
It has evolved from the proprietary Netscape before were also inherently multi-platform from the very start.

OpenOffice, evolved from the proprietary StarOffice, inherently multiplatform.

As for VLC, why exactly not having this one on Windows makes Linux any better. Can't Windows play Windows Media files? Does it lack a hundred of other players?

And I have another question for you: who do you think make products like Firefox popular. It's Windows users. The majority of people out there run Windows. It's when people started installing Firefox on their Windows machines, that the stats went up, and Firefox started to matter.

If Firefox never existed on Windows, do you think anyone but geeks would care for it? If you're thinking what answer might be, look no further from Konqueror: who the hell (but geeks) cared about this one browser which was only available on Linux, BEFORE Apple took their code and turned it in WebKit/Safari?

Re:It's the package selection process

[morgan_greywolf]

why do we have to push Linux on people? I'm a massive Linux fan, but I use windows as my main desktop mainly due to games but I use a lot of open source tools on my windows machine. main two being audacity and Firefox.

Actually, this brings up a very good point. For some applications like Audacity, the preferred platform may actually be Linux, or more specifically, distros that are aimed at being a professional audio/video workstation like Ubuntu Studio, which includes a low-latency kernel tuned for A/V work and dozens of audio tools that are only available on *nix. Audacity may work on Windows, but I've used it on both platforms and I much prefer to work with it on a low-latency-optimized Linux setup, right beside applications like Ardour with a plugin architecture like JACK.

Re:It's the package selection process

[TheRaven64]

The reboots are required for two reasons. The first is that you are updating a library that a lot of applications use. If you update libc, for example, then you need to restart every C application, which generally means a reboot. In a lot of cases, you can get away with just restarting the affected applications.

The second reason is Windows-specific. On UNIX, you can delete a file that applications have open, and it will not actually be removed from the disk until the last application with an open handle for it exits. On Windows, you can't do this. On *NIX, if you want up upgrade libfoo.so, you can delete it and then install the new libfoo.so, and every running application that uses it will keep using the deleted version until you restart it. On Windows, if you want to upgrade foo.dll, then it will tell you that you can't delete foo.dll because it is in use. This is why Windows installers often tell you to quit all applications. The work-around for this is to add a little script that replaces the old foo.dll with the new one on the next reboot (before anyone has tried loading it) and then continues.

I don't know if the second problem is fixed on Windows - I haven't used it for four or so years - but even if it has there are probably a lot of people out there writing installers who don't know that it's fixed.

Re:It's the package selection process

[westlake]

Windows' shaky foundations constitute the main incentive for Windows users to make the switch

The Microsoft platform can't be that shaky if Apple hasn't been able to get and hold 10% of the market in damn near twenty-five years.

Registry

[VE3OGG]

I would say the big thing that I would look for in such a product would be a consistent (or even better, non-existent) use/removal of registry entries. I have dealt with so many so-called "professionally" done software pieces that upon uninstallation would leave several dozen registry entries. This seems terribly unnecessary, and if the so-called apt-get method could circumvent the registry (much like the run from USB flash drive programs) altogether, or at least make it a sure-fire thing to remove, instead of wipe-and-pray.

Good on you for trying to better the system man, I wish you the best of luck!

Re:Security, security, security.

[KiloByte]

Uhm, let's compare signed repositories with grabbing those programs you need from websites, and quite a few of them use random services like download.com.
Quite a step forward in my book.

Cygwin packaging

[julesh]

I hope you're planning on making it interoperate with the cygwin packaging system. Cygwin's a great piece of software which is, IMO, let down by its obscure and difficult-to-use setup program. A new, friendlier way of installing and updating cygwin components would be a great asset. And if it worked with other OSS stuff as well, that would be a huge asset.

One thing I would suggest is that you make it easy for somebody to package a standalone .exe that doesn't require your system, but which can interoperate with your system easily -- perhaps by having a version of your system that can wrap up a package with a copy of the relevant parts of itself in a .exe file.

There may be an existing solution ...

[baileydau]

You may want to look at wpkg (http://wpkg.org/)

It is a windows package management system based on dpkg.

We use it at work and it appears to work fairly well. Although I don't know for sure, as I'm not the PC admin and I don't run a Windows desktop :)
I just get to hear him saying how much easier it is to manage the PCs with it.

Not sure

[Mostly a lurker]

Superficially, this seems an interesting project. I think, though, the problems with managing open source software on Windows are going to be very different to those on Linux: possibly to the point where what you can achieve will be limited.

The first issue that occurs to me immediately is that Windows has no single suitable native package management system that you can hook onto. Because of this, program installations tend either to (i) include whatever prerequisites they need and check whether their installation is necessary; or (ii) list the prerequisites in the installation instructions and leave it up to the user to ensure they are satisfied. Now, you might say that the whole point of the project is to resolve this, but I think you are going to run into licensing problems when you try. Let's say a particular open source product relies on .NET Framework 2. Are you then going to include .NET Framework 2 in your repository? Are you going to download it from Microsoft, using Microsoft's Download Center as a kind of adjunct repository? Are you going to talk to Microsoft to see if they will cooperate in working out a solution? This seems hard.

I do think that a single starting point for finding quality open source solutions on Windows has merit. Right now there is a bewildering mass of products out there, and no easy way of sifting the gems from the dross. If nothing else, you might be able to provide a good menu of open source products that are deemed worthy of consideration.

Good luck!

Re:A lot of work, but simple, conceptually...

[Rakishi]

Uhh, lets see now. With a linux type package manager I could:
-Actually install MySQL, PHP and Apache easily without having to use a third party package that holds them all. Yeah, windows is sure free of dependencies. Just great especially when your programs are inherently dependent on each other, oh wait no its a pain in the ass.
-Download whatever packages I need without needing to deal with searching the web for the place to download this from. The whole find, download install file, run install file thing gets annoying pretty quickly. Especially when you have a bunch of software to download.
-Queue uninstalls, god damn do I hate the fucking windows uninstaller where you need to uninstall, wait,uninstall next item. Thats not even counting how it fucking breaks in one way or another after a while on most systems I've used.

Updates system for OSS

[pubjames]

I have been thinking about this recently.

I have lots of applications, both OSS and commercial, that have some kind of update system built in - the application checks for an update when you start it, for instance, or when you select the option from the help menu. In fact it is getting to the stage where practically every app. has this.

What I would like to see is a single open method of doing this which could work for all applications (so even commercial software providers could opt into it if they wanted), which would be simple and secure. It would be great to have a single application open that ran at start-up that said: "The following applications have updates available:" and then lists the applications, and two buttons "Update all" and "Advanced" which would allow you to see details about the updates and select just the ones you want.

For instance on my Mac I have:

1) The Official Apple "Software update" that updates OSX and Apple Apps.
2) The Adobe updater for Photoshop, Dreamweaver etc.
3) The Firefox/Thunderbird updater
4) Dozens of updaters for individual apps like TextMate and OSS software
5) Updaters for OSS packages (Fink/darwinports)
(Yes, I know about the App Update widget but that only addresses part of the problem, and it does not provide a technical solution that can be used across platforms and projects).

And on Windows, I have the same kind of mess of updaters.

I'm sure there could be a simple, elegant technical solution for this, a kind of RSS-type standard for application updates - you could then choose your prefered updater just as you can now choose your preferred RSS reader.