4 ms·
Maybe ask the question the other way around. Why should they keep compiling everything from source? What are the benefits?
by _em6m 8y ago
Maybe ask the question the other way around. Why should they keep compiling everything from source? What are the benefits?
- black-tea 8y agoYou get native binaries, can choose optional features and dependencies and you can easily apply your own choice of patches. That's my view as a gentoo user anyway; I don't know how much of that homebrew actually supports.
- saagarjha 8y agoHomebrew used to support optional features, but is now moving away from this to become a binary package manager.
- ninkendo 8y agoWhat does “native binary” mean?
- michaericalribo 8y agoCompiled locally, so (posssibly) optimized for better performance than a generic binary compiled for your architecture.
- black-tea 8y agoCompilers like GCC can produce code specifically for your CPU such that it uses all of the special features you might have like SSE, AVX etc. When binaries are made for general use they have to be compiled with a generic feature set so might not make best use of your CPU.
- h1d 8y agoAt least it should no longer take a night to compile some GUI app like back in the days.
- bobwaycott 8y agoWell, for one, as a longtime brew user, changing to binary packages alters the trust model.
- devzer0 8y agoBinaries are built on CI infra with logs that are publicly available and with all the source code doing the builds publicly available. Effectively the same process as local, from source builds. The bottle DSL ensures that the SHA binaries are not tampered with between when they were built (and the source code sha checked) and when they are delivered. I know this is still a different trust model, but, IMO, not too different. I know reproducible builds are on the radar for Homebrew in the future, and that should ease some of your concerns too. For a good thread on Homebrew security checkout https://twitter.com/c_pellegrino/status/1093195802871246848 https://twitter.com/c_pellegrino/status/1093195802871246848
- bobwaycott 8y agoHey! Thanks for the reply. I’ll definitely check that link out. It’s really nice to know more about the process behind delivering binaries.
- eslaught 8y agoCompare to e.g. conda, where you get binary packages and no option to build from source at all. This basically means you get support for x86 and very limited support for PPC. Need ARM? Nope, no can do. Or any other slightly exotic architecture. It also means, though this is only a problem with third party channels, that it's possible to get into a situation where you can't even build from source at all. I was working with one of our custom packages, where for the life of me I could not figure out how to get the build to work. Turns out it had been hardcoded to run on a very specific machine, and assumed access to a very specific network file system, and I wasted about a week of my life trying to untangle those assumptions before giving up. If that software had been designed from the beginning with the idea that it ought to be possible to build from source from anywhere, we'd presumably be in a different situation now.