3 ms·

Can’t we just move to have package managers point to a curated list of packages by default, with the option to enable an uncurated one if you know what your doi

Can’t we just move to have package managers point to a curated list of packages by default, with the option to enable an uncurated one if you know what your doing , ala Ubuntu source lists?

miohtama 2y ago
Yes. But that would mean someone needs to work harder.
ozim 2y ago
Then you are stuck on whatever passes the gates. It is shitloads of work to maintain. Getting new package from 0 to any Linux distribution is close to impossible. Debian sucks as no one gets on top of reviewing and testing. „Can we just” is not just there is loads of work to be done to curate packages no one is willing to pay for it. There is so far no model that works where you can have up to date cutting edge stuff reviewed. So you are stuck with 5 year old crap because it was reviewed.
- tasuki 2y ago
  So many good packages made it into Debian relatively recently! Eg: fzf, fd-find, ripgrep, jq, exa, nvim, ...
  - mvdtnz 2y ago
    I was excited to see you mention fzf in Debian so I just installed it and it's an ancient version that doesn't support shell integration. Not a great look.
    - pabs3 2y ago
      fzf 0.60.3-1 from March 3rd is the latest in Debian, 0.61.1 from April 4 the latest upstream, so Debian is not exactly ancient. I guess you are using stable Debian? That doesn't get newer upstream releases, if you want the latest Debian fzf you can just install the build from unstable, which should work fine since Go does static linking, and there are often backports for when unstable packages can't be installed on stable. https://github.com/junegunn/fzf/tags https://github.com/junegunn/fzf/tags https://tracker.debian.org/pkg/fzf https://tracker.debian.org/pkg/fzf
      - mvdtnz 2y ago
        I don't know what to tell you - I just typed "sudo apt install fzf" and got 0.48. Yes, I'm using stable like most people.
    - tasuki 2y ago
      I'm using Debian stable and its fzf. What do you mean by "doesn't support shell integration"? I use it... in my shell? Using various shortcuts? Ctrl+T to select file? Alt+C to change dir? Ctrl+R to search history? I use this for my shell integration: function maybe_source { [ -f "$1" ] && source "$1" } maybe_source /usr/share/doc/fzf/examples/key-bindings.zsh maybe_source /usr/share/doc/fzf/examples/completion.zsh
jononor 2y ago
At least having good integrated support in the package manager for an allow-list of packages would be good. Then one could maintain such lists in a company or project. And we could have community efforts to develop shared curated lists that could be starting points. If that really catches on, one could consider designating one of them as a default. Might also want to support multiple allow lists, so one can add to a standard list in a project (after review). And also deny, so one can remove a few without exiting completely from common lists.

Can’t we just move to have package managers point to a curated list of packages by default, with the option to enable an uncurated one if you know what your doing , ala Ubuntu source lists?

miohtama 2y ago

Yes. But that would mean someone needs to work harder.

ozim 2y ago

Then you are stuck on whatever passes the gates. It is shitloads of work to maintain. Getting new package from 0 to any Linux distribution is close to impossible. Debian sucks as no one gets on top of reviewing and testing. „Can we just” is not just there is loads of work to be done to curate packages no one is willing to pay for it. There is so far no model that works where you can have up to date cutting edge stuff reviewed. So you are stuck with 5 year old crap because it was reviewed.

tasuki 2y ago
So many good packages made it into Debian relatively recently! Eg: fzf, fd-find, ripgrep, jq, exa, nvim, ...
- mvdtnz 2y ago
  I was excited to see you mention fzf in Debian so I just installed it and it's an ancient version that doesn't support shell integration. Not a great look.
  - pabs3 2y ago
    fzf 0.60.3-1 from March 3rd is the latest in Debian, 0.61.1 from April 4 the latest upstream, so Debian is not exactly ancient. I guess you are using stable Debian? That doesn't get newer upstream releases, if you want the latest Debian fzf you can just install the build from unstable, which should work fine since Go does static linking, and there are often backports for when unstable packages can't be installed on stable. https://github.com/junegunn/fzf/tags https://github.com/junegunn/fzf/tags https://tracker.debian.org/pkg/fzf https://tracker.debian.org/pkg/fzf
    - mvdtnz 2y ago
      I don't know what to tell you - I just typed "sudo apt install fzf" and got 0.48. Yes, I'm using stable like most people.
  - tasuki 2y ago
    I'm using Debian stable and its fzf. What do you mean by "doesn't support shell integration"? I use it... in my shell? Using various shortcuts? Ctrl+T to select file? Alt+C to change dir? Ctrl+R to search history? I use this for my shell integration: function maybe_source { [ -f "$1" ] && source "$1" } maybe_source /usr/share/doc/fzf/examples/key-bindings.zsh maybe_source /usr/share/doc/fzf/examples/completion.zsh

jononor 2y ago

At least having good integrated support in the package manager for an allow-list of packages would be good. Then one could maintain such lists in a company or project. And we could have community efforts to develop shared curated lists that could be starting points. If that really catches on, one could consider designating one of them as a default. Might also want to support multiple allow lists, so one can add to a standard list in a project (after review). And also deny, so one can remove a few without exiting completely from common lists.