3 ms·
THat'd be great, though there are many issues to handle: - packages don't have the same name across distributions: python or python2? python or python3? - mos
by moviuro 7y ago
THat'd be great, though there are many issues to handle:
- packages don't have the same name across distributions: python or python2? python or python3?
- most binaries don't have the same checksum (except scripts that aren't compiled: not many files)
- paths tend to change across distriutions: usual Linux has /bin/bash, FreeBSD has /usr/local/bin/bash, NixOS has... something else.
The closest I can think of are the per-distro databases, along with security advisories:
- warning: huge page hxxps://packages.debian.org/stable/allpackages ; https://www.debian.org/security/dsa-long https://www.debian.org/security/dsa-long
- https://www.archlinux.org/feeds/packages/ https://www.archlinux.org/feeds/packages/ https://security.archlinux.org/ https://security.archlinux.org/
- http://pkg.freebsd.org/FreeBSD:12:amd64/latest/ http://pkg.freebsd.org/FreeBSD:12:amd64/latest/ https://www.freebsd.org/security/advisories.html https://www.freebsd.org/security/advisories.html + http://vuxml.freebsd.org/ http://vuxml.freebsd.org/
- etc.
- _jal 7y agoThere are a lot of fuzzy edges. One big one is managing different aspects of "sameness" for a file in different contexts that makes sense. You mentioned the problems with binary hashes; there are others, like comments in scripts and config files. If distro-X just spams boilerplate at the top of the config file, is that the "same" file? What if they add or rewrite informational comments in a config file? I think the answer is that sometimes they are; it depends on the question. I also noticed that it is really easy to end up wanting to pull data from source repos and bug trackers, but down that path lies madness. Anyway, I don't have any plans to start building this. But it is an interesting project to think through.