3 ms·

A modern way to work around this problem is using distro agnostic containerized packages like snaps, flatpaks, nix, guix or homebrew. I've been using old Ubunt

A modern way to work around this problem is using distro agnostic containerized packages like snaps, flatpaks, nix, guix or homebrew. I've been using old Ubuntu distros which still get security patches with flatpaks. This gives me a good balance of stability and modern user space software. As an experiment, I'm keeping a Debian 11 in which I installed flatpak and GNU Guix. I can use very recent GCC versions and still have a very stable system. I still plan to install homebrew on it to watch how the different parts will interact.

amelius 5y ago
How do you install stuff that you compile from source?
- marcodiego 5y ago
  Most things compiled from source default to /usr/local , so they may interfere but not break package manager installed packages. It is also possible to use --prefix while configuring, so I can install it without using sudo , but I have to change some environment vars to use it. I still haven't tried it, but my next step will be to try homebrew.
  - amelius 5y ago
    Homebrew also messes with /usr/local (it stores symlinks there), so this could interfere with the native package manager, I suppose. For example, if you install and then purge a package, it could overwrite symlinks and then remove them (also if the package is a dependency of the package you're interested in). Also, how would you install Python wheels in a system-wide manner?
    - marcodiego 5y ago
      > Homebrew also messes with /usr/local (it stores symlinks there), so this could interfere with the native package manager, I suppose. For example, if you install and then purge a package, it could overwrite symlinks and then remove them (also if the package is a dependency of the package you're interested in). This is the output of "tree /usr/local" on my non-experimental system: marco@marco-Inspiron-3421:~$ tree /usr/local/ /usr/local/ ├── bin ├── etc ├── games ├── include ├── lib │ ├── python2.7 │ │ ├── dist-packages │ │ └── site-packages │ └── python3.8 │ └── dist-packages ├── man -> share/man ├── sbin ├── share │ ├── ca-certificates │ ├── fonts │ ├── man │ ├── sgml │ │ ├── declaration │ │ ├── dtd │ │ ├── entities │ │ ├── misc │ │ └── stylesheet │ ├── texmf │ └── xml │ ├── declaration │ ├── entities │ ├── misc │ └── schema └── src 29 directories, 0 files It has a lot of packages installed but, as you can see, the package manager never wrote a file in /usr/local. So I think it is safe to assume things installed to /usr/local will not interfere with the package manager. > Also, how would you install Python wheels in a system-wide manner? No sure, but I think it can be done with guix.
mmis1000 5y ago
Do you also bump the kernel version? I think container managers make use of new kernel security measurements. Some functionality probably won't work(or silently disabled) if the kernel is way too old.
- marcodiego 5y ago
  On my stable system, I leave the kernel to the package manager. On my experimental system, I compiled a recent kernel.

amelius 5y ago

How do you install stuff that you compile from source?

marcodiego 5y ago
Most things compiled from source default to /usr/local , so they may interfere but not break package manager installed packages. It is also possible to use --prefix while configuring, so I can install it without using sudo , but I have to change some environment vars to use it. I still haven't tried it, but my next step will be to try homebrew.
- amelius 5y ago
  Homebrew also messes with /usr/local (it stores symlinks there), so this could interfere with the native package manager, I suppose. For example, if you install and then purge a package, it could overwrite symlinks and then remove them (also if the package is a dependency of the package you're interested in). Also, how would you install Python wheels in a system-wide manner?
  - marcodiego 5y ago
    > Homebrew also messes with /usr/local (it stores symlinks there), so this could interfere with the native package manager, I suppose. For example, if you install and then purge a package, it could overwrite symlinks and then remove them (also if the package is a dependency of the package you're interested in). This is the output of "tree /usr/local" on my non-experimental system: marco@marco-Inspiron-3421:~$ tree /usr/local/ /usr/local/ ├── bin ├── etc ├── games ├── include ├── lib │ ├── python2.7 │ │ ├── dist-packages │ │ └── site-packages │ └── python3.8 │ └── dist-packages ├── man -> share/man ├── sbin ├── share │ ├── ca-certificates │ ├── fonts │ ├── man │ ├── sgml │ │ ├── declaration │ │ ├── dtd │ │ ├── entities │ │ ├── misc │ │ └── stylesheet │ ├── texmf │ └── xml │ ├── declaration │ ├── entities │ ├── misc │ └── schema └── src 29 directories, 0 files It has a lot of packages installed but, as you can see, the package manager never wrote a file in /usr/local. So I think it is safe to assume things installed to /usr/local will not interfere with the package manager. > Also, how would you install Python wheels in a system-wide manner? No sure, but I think it can be done with guix.

mmis1000 5y ago

Do you also bump the kernel version? I think container managers make use of new kernel security measurements. Some functionality probably won't work(or silently disabled) if the kernel is way too old.

marcodiego 5y ago
On my stable system, I leave the kernel to the package manager. On my experimental system, I compiled a recent kernel.