4 ms·

Usually there's a few tiers of packages, with the first tier packages being extensively tested and maintained, and the second tier packages mostly just provided

by jey 14y ago

Usually there's a few tiers of packages, with the first tier packages being extensively tested and maintained, and the second tier packages mostly just provided as a convenience. I believe Debian calls the first-tier "main" and the second-tier "contrib" (and Ubuntu calls them "main" and "universe").

binarycrusader 14y ago
Yep, I'm aware of that. Although not every Linux distribution makes that distinction and the person to whom I replied certainly didn't leave room for that. But in the past, even the packages in the "first tier" were often pretty busted. But even for that tier, Linux distributions are not performing "extensive vetting and rigorous testing". They don't generally test beyond relying that other components that use it work as expected, and for many components, those are only as well tested as the tests that are included with the component. Yes, some distributions do run security analysis tools or other things on the components they integrate, but that still doesn't count as "extensive vetting and rigorous testing".
marcosdumay 14y ago
The main repository is for free software, the non-free repository is for non free software, and the contrib repository is for free softwre that you must agree to some non-free license to actualy use (because they depend on non-free software, they are just installers, or for any other reason). Those are not different tiers of software stability. Debian has the unstable, testing and stable distros, that move on different speeds and are subject to different amounts of testing.
jzwinck 14y ago
I've had breakages in Cygwin's emacs (missing GNUTLS dependency), Fedora's node.js (mismatched version of v8), GCC 4.7 (C++11 ABI regression, widely reported), Fedora 17's sssd (broke network login after upgrade), and perhaps most galling, Fedora 16's cron (which completely failed if you upgraded from 15). That's just in the past year. I don't think any of those packages are particularly niche or stale. I used to think maintainers were making miracles...now I think they're doing just OK.

by jey 14y ago

binarycrusader 14y ago

Yep, I'm aware of that. Although not every Linux distribution makes that distinction and the person to whom I replied certainly didn't leave room for that. But in the past, even the packages in the "first tier" were often pretty busted. But even for that tier, Linux distributions are not performing "extensive vetting and rigorous testing". They don't generally test beyond relying that other components that use it work as expected, and for many components, those are only as well tested as the tests that are included with the component. Yes, some distributions do run security analysis tools or other things on the components they integrate, but that still doesn't count as "extensive vetting and rigorous testing".

marcosdumay 14y ago

The main repository is for free software, the non-free repository is for non free software, and the contrib repository is for free softwre that you must agree to some non-free license to actualy use (because they depend on non-free software, they are just installers, or for any other reason). Those are not different tiers of software stability. Debian has the unstable, testing and stable distros, that move on different speeds and are subject to different amounts of testing.

jzwinck 14y ago

I've had breakages in Cygwin's emacs (missing GNUTLS dependency), Fedora's node.js (mismatched version of v8), GCC 4.7 (C++11 ABI regression, widely reported), Fedora 17's sssd (broke network login after upgrade), and perhaps most galling, Fedora 16's cron (which completely failed if you upgraded from 15). That's just in the past year. I don't think any of those packages are particularly niche or stale. I used to think maintainers were making miracles...now I think they're doing just OK.