3 ms·

It's because we need a user-space package manager. System package managers require root access to be handled and tend to provide only a single stable version o

by zimbatm 12y ago

It's because we need a user-space package manager. System package managers require root access to be handled and tend to provide only a single stable version of each package. While they are good to provide the base system, on the application level it's desirable to use specific version of libraries.

Hello71 12y ago
> It's because we need a user-space package manager. that word doesn't mean what you think it means > System package managers require root access to be handled nope, Gentoo Prefix can be installed by anyone, as long as you have somewhere that's u+w and exec. > and tend to provide only a single stable version of each package. nope, Gentoo allows any versions of every package to be mixed and matched, as long as the underlying platform and package supports it.
- zimbatm 12y ago
  Is Gentoo Prefix installable on other platforms ? If you want to match the language-specific package managers you also have to be able to support at least the common POSIX platforms and allow per-project dependencies management.
Svenstaro 12y ago
Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. And as far as I know, only Linux distro package repositories even have backports, not application package repos.
- zimbatm 12y ago
  There's value in having automatic system updates for the common base. Once you go on the road of unsupported libraries that would be bundled with your application more work is involved for upgrades. Even with semantic versioning you depend on the author to do it properly. It's best if upgrades can be controlled to avoid regressions.
- e12e 12y ago
  > Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. Not necessarily. There's great value in having stable "long time support" versions of libraries, that are not the latest version, but often have backported security fixes. New features introduce new bugs, some (most?) new bugs will be (new) security issues. [ed: For a new application, tracking upstream is often the best way -- say you assume to have a stable(ish) release of your application in 6 months, you don't want to miss out on new features that'll be available in a supported release of some library you're using. But it doesn't follow that you should always migrate to the latest release of that library.]

by zimbatm 12y ago

Hello71 12y ago

> It's because we need a user-space package manager. that word doesn't mean what you think it means > System package managers require root access to be handled nope, Gentoo Prefix can be installed by anyone, as long as you have somewhere that's u+w and exec. > and tend to provide only a single stable version of each package. nope, Gentoo allows any versions of every package to be mixed and matched, as long as the underlying platform and package supports it.

zimbatm 12y ago
Is Gentoo Prefix installable on other platforms ? If you want to match the language-specific package managers you also have to be able to support at least the common POSIX platforms and allow per-project dependencies management.

Svenstaro 12y ago

Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. And as far as I know, only Linux distro package repositories even have backports, not application package repos.

zimbatm 12y ago
There's value in having automatic system updates for the common base. Once you go on the road of unsupported libraries that would be bundled with your application more work is involved for upgrades. Even with semantic versioning you depend on the author to do it properly. It's best if upgrades can be controlled to avoid regressions.
e12e 12y ago
> Shouldn't software optimally always use the newest version of all the libraries it depends on? It's a security issue if they don't. Not necessarily. There's great value in having stable "long time support" versions of libraries, that are not the latest version, but often have backported security fixes. New features introduce new bugs, some (most?) new bugs will be (new) security issues. [ed: For a new application, tracking upstream is often the best way -- say you assume to have a stable(ish) release of your application in 6 months, you don't want to miss out on new features that'll be available in a supported release of some library you're using. But it doesn't follow that you should always migrate to the latest release of that library.]