Discussion on repository, packages, etc. (split from Some thoughts thread)
- Thread starter benoitb
- Start date
ptitSeb
Serial Porter
Well, I propose you do it that way with your port(s). Feel free to double the works and the sources package handling (one for the deb, one for the dbp). (both upload & download).
It's a good thing because of proper dependency handling. Otherwise all game packages should include all dependencies because you want the game to run without any additional steps on pyra.
All android/ios tablets and phones install programs the same way - using the device.
If you're (hypothetically) comfortable maintaining a single proper deb then it's possible to do the rest automatically (split the package into two, upload). Automatic download is also possible.
ptitSeb
Serial Porter
where is that dislike button?
- Joined
- Jan 18, 2010
- Messages
- 11,411
Sure, but some dependency tracking is supposed to be implemented in the DBP system. I believe that may still be work in progress. I'm not sure what additional steps you speak of, what is current on the debian jessie repository will be the base dependencies, anything extra can be bundled in the DBP file.
That's the issue, a debian style repository is restrictive for a community that promotes just about anyone to publish software for it. The Pyra specific Debian repository should only be handled by the people involved with OS development as giving just any person access to upload could become problematic. If such a system existed like you suggest then someone(s) would have to be vigilantly monitor who uploads what.
EDIT: Split this out from Some Thoughts thread..
Last edited by a moderator:
Hồng Thất Công
Đả Cẩu Bổng Pháp
Last edited by a moderator:
comradekingu
Glowing ember
Aspects of removing the card aside. Its convenient to just apt-get.
If the customized and optimized packages are packaged as debs in repos that can just be dropped into /etc/apt.sources.list then the system can prioritize the best versions.
No need for the user to look both places, and know that one is preferable.
Given the choice, ill take upgrading the whole system in an easy manner, with dependencies settled, the debian way, every time.
There are ways to sneakernet, but thats another discussion.
Why are debian repos restrictive? Ubuntu is doing user specific apt-add-repository and thats very prevalent.
If the customized and optimized packages are packaged as debs in repos that can just be dropped into /etc/apt.sources.list then the system can prioritize the best versions.
No need for the user to look both places, and know that one is preferable.
Given the choice, ill take upgrading the whole system in an easy manner, with dependencies settled, the debian way, every time.
There are ways to sneakernet, but thats another discussion.
Why are debian repos restrictive? Ubuntu is doing user specific apt-add-repository and thats very prevalent.
Last edited by a moderator:
- Joined
- Jan 18, 2010
- Messages
- 11,411
Well the former is a HUGE thing to just put aside. Currently I think best case scenario we get a 16GB eMMC, I would say Debian and decent amount of utilities and developers tools takes about half of it. If we only get an 8GB eMMC we will have similar issues to the Pandora as the OS will just fit on it with some breathing room.
Because someone still needs to manage them vs an open to all method the DBP would give. Then what do we run into, a bunch of people with their own separate apt-add-repositories?
Last edited by a moderator:
comradekingu
Glowing ember
If only that worked on debian. But yes, you could however aggregate it like you want.
Gentoo and arch, tinycore and a few others have user-packages in the distro in some way or another. Some provide the hosting too. https://wiki.debian.org/UnofficialRepositorieslists a few options.
How about an in-between option for people who like uSD cards more than eMMC? Just automated compilation of everything with optimized options.
Could you explain why dpb is more open to all? I was under the assumption that malicious software gets taken off the repo.
Gentoo and arch, tinycore and a few others have user-packages in the distro in some way or another. Some provide the hosting too. https://wiki.debian.org/UnofficialRepositorieslists a few options.
How about an in-between option for people who like uSD cards more than eMMC? Just automated compilation of everything with optimized options.
Could you explain why dpb is more open to all? I was under the assumption that malicious software gets taken off the repo.
Last edited by a moderator:
- Joined
- Jan 18, 2010
- Messages
- 11,411
Well can just any get permission to upload to one of these apt-add repositories without being authorized to do so? Having someone as a gatekeeper makes it more restrictive.
Last edited by a moderator:
It seems to me that library dependencies tend to be rather small, so there is minimal cost (SD cards seem to be approximately $1 per GiB) to simply statically linking everything -- I expect most Pyra games and emulators need not worry about security updates for their dependencies. Statically link and distribute a tar.gz file.
comradekingu
Glowing ember
They are called PPAs, but they only work for ubuntu. You just need a launchpad account. I suppose cannonical will toss you out if it is discovered that you put malicious stuff up.
Neelix
Insecticidal Maniac
And practically every individual publisher has to have their own PPA that you have to 1) know about and 2) manually add in order to use them.
That's very different to our PND repo which is one central source that anyone can contribute to. This is one of the strengths of the Pandora community and one we should replicate for the Pyra.
- Neelix
That's very different to our PND repo which is one central source that anyone can contribute to. This is one of the strengths of the Pandora community and one we should replicate for the Pyra.
- Neelix
That is the original purpose of the debian package management system and its repositories, you know.
What do you mean by handling? Regenerate package list from time to time?
comradekingu
Glowing ember
I never meant that we should let just anyone upload to pyra-main.
What im saying is that by going on the repo and clicking something you are effectivly saying "i trust person who made this" and that "download didnt fail on the way over to me"
Generating a sources.list and implementing that, is the functional equivalent. Ala this is the low-end way.
Or you just browse the online repos, and hit the apt:// links.
I dont think its a particularly bad idea to alert the user to "this is a new repo-user, trust y/n?"
What i dislike the most about the repo as it is now is that i cant be sure of package-integrity, and that i cant exclude non-free. Nor can i see license in most cases. Nor do i find source-packages.
I think ideally the repo and package-manager should both be very light applications, relying on the heavy debian backend that someone else is doing the heavy work on, and has been battle-tested.
Debian is NIH too, and its gotten only praise apart from systemd.
What im saying is that by going on the repo and clicking something you are effectivly saying "i trust person who made this" and that "download didnt fail on the way over to me"
Generating a sources.list and implementing that, is the functional equivalent. Ala this is the low-end way.
Or you just browse the online repos, and hit the apt:// links.
I dont think its a particularly bad idea to alert the user to "this is a new repo-user, trust y/n?"
What i dislike the most about the repo as it is now is that i cant be sure of package-integrity, and that i cant exclude non-free. Nor can i see license in most cases. Nor do i find source-packages.
I think ideally the repo and package-manager should both be very light applications, relying on the heavy debian backend that someone else is doing the heavy work on, and has been battle-tested.
Debian is NIH too, and its gotten only praise apart from systemd.
Last edited by a moderator:
- Joined
- Jan 18, 2010
- Messages
- 11,411
No I'm talking about adding new content to the pyra Debian repository.
Last edited by a moderator:
Well, while I've not ported any major things to the Pandora, only small but often nice games, I can say I would NOT port anything if I have to put it into a Debian repository...
Setting up the build Debian build server and some debian repositories (with a lot of help from aTc), I now know that building proper debian packages is pretty much horrible.
So we'd lose a lot of devs that way, in my opinion.
Setting up the build Debian build server and some debian repositories (with a lot of help from aTc), I now know that building proper debian packages is pretty much horrible.
So we'd lose a lot of devs that way, in my opinion.
ptitSeb
Serial Porter
Same for me. I don't want, for now, to spend (lose?) time in Debian thingy.
No, the package system just encodes some metadata that allows automated installation decisions (as a user convenience) provided said metadata is 100% correct. It doesn't do magic (which would be required for proper dependency handling; ok, I lied: correctness proofs would suffice).
Don't confuse the fact that Debian/Ubuntu/... each have hordes of developers and testers to make sure that the breakage within the stable repositories is reduced to a minimum (as long as you don't add external package sources) with proper dependency handling. There is nothing (concerning dependencies) that makes DPKs (or whatever system you prefer) in any way superior to PNDs. Actually they are an additional burden on developers (but I hope that has become clear already from ptitSeb's reaction).
Similar threads
