4 ms·

The actual Ubuntu has already tried to move to the AppImage-like package management: it's when you put all dependencies of the program into the package. These "

The actual Ubuntu has already tried to move to the AppImage-like package management: it's when you put all dependencies of the program into the package. These "Click" packages were used for the UbuntuPhone applications. There were also "Snap" packages for more server-oriented use cases. The whole deal is about the software developers who are having hard time managing the dependencies. Because they've got to update the code all the time. Especially bad for the proprietary ship-once-and-forget software. Ubuntu has not changed the package format. To be used, it has to be tested. To be tested, it has to be used.

colechristensen 8y ago
It's time for new package management. One that isn't snapshot images (docker, bundled java/ruby/libraries) One that takes testing and integration seriously One that takes security seriously One that uses c-groups like they were intended One that allows multiple versions There are a lot of things that could come together for a new style and generation of package manager, but to do it right you would have to manage a whole lot of things
- ravloony 8y ago
  It seems to me like nix fits all of those criteria.
- nine_k 8y ago
  Let's take a look at Nix and Guix. Which checkboxes of the above list they fail to check? Cannot reasonably check?
- weberc2 8y ago
  Honestly not sure why this is downvoted. Would really like to hear from the contrarians since none of this strikes me as controversial. I am curious why "snapshot images" are bad though. What's the fundamental difference between this and shipping a static binary (they're just a different image format, right?).
  - tomc1985 8y ago
    hardly.... the whole point of dynamic linking (and shipping or not shipping dynamically-linked binaries) is to reduce the amount of redundant code on a system. (it also helps keep update sizes down.) If you're shipping application images then youre shipping copies of all your library code -- you might as well have made a static binary; it certainly would be easier to work with.
    - weberc2 8y ago
      > you might as well have made a static binary; it certainly would be easier to work with Not all programming languages can produce static binaries. That's the point of an image format to begin with. Reducing redundant code is a nice idea, but there aren't any systems^1 that solve for dependency hell and disk efficiency, and I'd rather trade a few hundred MBs of disk than fight with dependency hell. ^1: This isn't entirely true; Nix (and friends) do solve for this, but it's a relatively niche system and it's got its own usability issues that are (in my opinion) well worth sacrificing some disk to avoid. If these systems cross that threshold, then I'm happy to jump on that bandwagon.
      - michaelmrose 8y ago
        As a user of linux on the desktop since 2003 I haven't seen any "dependency hell" save for packages not designed for the current distro/version or software not properly packaged. Usually proprietary crap NOT in your distros repos.
      - tomc1985 8y ago
        APT (on linux) and MSI (on Windows) platforms both attempt to solve for those factors. Both are also bedrocks for the the operating systems they are designed for. Everyone else on this thread seems to be skipping right over both these names. Why?
        weberc2 8y ago
        Can't speak to MSI, but apt doesn't do a very good job. For me, this manifests in an error like "one of your packages is broken, run again with the -f flag to fix it" which has never ever ever worked for me ever. I've had some luck with aptitude in the past, but it often fails to resolve because you're only allowed one version of a package on your system at a time. Static linkage on the other hand is pretty close to foolproof.
- tomc1985 8y ago
  APT satisfies most of those already, if you use it right
- michaelmrose 8y ago
  Security at the package manager level is closing the barn door after the horse has gone. As far as I can see you can't have a useful system and be able to install malware safely. The best choice continues to be curation. Testing is logically discrete from package management its entirely possible to test well or poorly with any system. For several other points nix also featured on the front page right now seems interesting.
GordonS 8y ago
Does this new package management system mean that each package is deployed with it's own version of dependencies? Or are dependencies only installed once, in a central location, like they are with 'traditional' Linux package management systems?

colechristensen 8y ago

It's time for new package management. One that isn't snapshot images (docker, bundled java/ruby/libraries) One that takes testing and integration seriously One that takes security seriously One that uses c-groups like they were intended One that allows multiple versions There are a lot of things that could come together for a new style and generation of package manager, but to do it right you would have to manage a whole lot of things

ravloony 8y ago
It seems to me like nix fits all of those criteria.
nine_k 8y ago
Let's take a look at Nix and Guix. Which checkboxes of the above list they fail to check? Cannot reasonably check?
weberc2 8y ago
Honestly not sure why this is downvoted. Would really like to hear from the contrarians since none of this strikes me as controversial. I am curious why "snapshot images" are bad though. What's the fundamental difference between this and shipping a static binary (they're just a different image format, right?).
- tomc1985 8y ago
  hardly.... the whole point of dynamic linking (and shipping or not shipping dynamically-linked binaries) is to reduce the amount of redundant code on a system. (it also helps keep update sizes down.) If you're shipping application images then youre shipping copies of all your library code -- you might as well have made a static binary; it certainly would be easier to work with.
  - weberc2 8y ago
    > you might as well have made a static binary; it certainly would be easier to work with Not all programming languages can produce static binaries. That's the point of an image format to begin with. Reducing redundant code is a nice idea, but there aren't any systems^1 that solve for dependency hell and disk efficiency, and I'd rather trade a few hundred MBs of disk than fight with dependency hell. ^1: This isn't entirely true; Nix (and friends) do solve for this, but it's a relatively niche system and it's got its own usability issues that are (in my opinion) well worth sacrificing some disk to avoid. If these systems cross that threshold, then I'm happy to jump on that bandwagon.
    - michaelmrose 8y ago
      As a user of linux on the desktop since 2003 I haven't seen any "dependency hell" save for packages not designed for the current distro/version or software not properly packaged. Usually proprietary crap NOT in your distros repos.
    - tomc1985 8y ago
      APT (on linux) and MSI (on Windows) platforms both attempt to solve for those factors. Both are also bedrocks for the the operating systems they are designed for. Everyone else on this thread seems to be skipping right over both these names. Why?
      - weberc2 8y ago
        Can't speak to MSI, but apt doesn't do a very good job. For me, this manifests in an error like "one of your packages is broken, run again with the -f flag to fix it" which has never ever ever worked for me ever. I've had some luck with aptitude in the past, but it often fails to resolve because you're only allowed one version of a package on your system at a time. Static linkage on the other hand is pretty close to foolproof.
tomc1985 8y ago
APT satisfies most of those already, if you use it right
michaelmrose 8y ago
Security at the package manager level is closing the barn door after the horse has gone. As far as I can see you can't have a useful system and be able to install malware safely. The best choice continues to be curation. Testing is logically discrete from package management its entirely possible to test well or poorly with any system. For several other points nix also featured on the front page right now seems interesting.

GordonS 8y ago

Does this new package management system mean that each package is deployed with it's own version of dependencies? Or are dependencies only installed once, in a central location, like they are with 'traditional' Linux package management systems?