3 ms·
In principle "traditional" curated Linux distro package systems will patch stuff even if upstream is unresponsive.
by cozzyd 1y ago
In principle "traditional" curated Linux distro package systems will patch stuff even if upstream is unresponsive.
- hsbauauvhabzb 1y agoSorry I should have clarified that I was referring to language based systems (cargo, pip, npm, etc). But you do raise a good point, it’s less about the concept of package management and more around the point of curation and central security guarantees / policies / procedures. In theory RHEL package management system could have similar problems to cargo or npm, but they are much better funded and thus managed.
- ajross 1y agoIn practice, not principle. Virtually every non-trivial upstream package in debian/fedora/arch/whatever has at least a handful of distro-specific patches. Sometimes they're just configuration, sometimes they're distro-maintained security fixes, etc... But people exercise those features regularly and distros are not shy about maintaining software. It's a very different world from "We Just Ship What They Give Us" in npm/cargo/etc...