Comment by zlatan_todoric | Hacker News Reader

Comment by zlatan_todoric | Hacker News Reader

Parent Full thread

There is a big difference in quality of packages. Debian primary focus is stability, security, upgrading from 5 years old package to newest, strict freedom.

You can build Debian packages as Arch but that wouldn't be the Debian way.

Stability - our QA process is huge and much more strict then the Arch one. We often notice upstream bugs during our packaging and testing process and we also often patch them before upstream.

Security - we have Debian Security Team which is ruthless and security is a big focus so when for example the Chromium security problems was found, it was also noticed that that feature was disabled in Debian chromium package by default.

Upgrading - I don't think any distro can offer this without issues and those issues are exactly prevented with out packaging guides and Debian Policy. In Arch you would get from time to time - please do this manual things in order to upgrade to next version of this software. While in Debian you can go to trip to Mars, live there for few years, come back and then just apt update && apt dist-upgrade the thing and go on coffee without worry.

Also notice we had much before Arch the gpg signing of packages, you can't become Debian maintainer without at least two Debian Developer signatures on your key which happen in face-to-face meetings (so we create a web of trust you will not introduce bad code in your packaging).

So yes, you are correct that easier is to create Arch package then Debian official one, but in Debian you can also create very quickly packages (checkinstall, fpm etc etc) but then you miss all the power of Debian and you're on your own with those packages and potential breakage with system (or is that a freedom you have?) :)

You are conflating curation/QA and packaging. Packaging itself should not care about the quality of the packages.

It's well known that the debian repositories are extremely well reviewed and tested. But you could have that with Arch's packaging system as well.

When someone builds a package themselves however, they are not expecting Debian's QA & testing nor are they usually interested in it. But a package, untested as it may be, is far, far better than a sudo make install.

When I used debian this was such a huge pain. Building packages was not worth the hassle so I would simply sudo make install and feel awful about it, and end up with conflicts and everything that a package manager is supposed to solve...

You see, there is where you mistake. Debian official packaging is about Quality of package. Lintian checks for example is your library really a library or it maybe contains scripts, did you make a mistake in description (simple letter mistake), did you miss new copyright files (or change in copyright of the same). There is also a reason why it suggests building in clean chroots, installation in same clean environment. You also have piuparts to check it's transition. Debian packaging is a huge thing and it would take me quite a time to explain it and I would still miss something. Also our packaging assumes that not all upstreams make sane coding or installation scripts so we detect them before just pushing them into system.

As you said, Arch could have all that but it doesn't and there are the reason why people who use Debian don't use Arch. Again, you can quickly make deb packages without following any of our docs and no, package manager should not solve what differs from our official build quality and Debian Policy (it would be too much hassle to predict and implement in how many ways people can break their system).

I am glad that Arch exists, so everyone has a freedom to choose it if they want :)

Arch does have a lot of that. Not all of it, but it does have clean chroot building, gpg signing, linting etc. Mostly, arch does less testing as the philosophy is "trust upstream".

However, none of this is required for unofficial packages. You can do it, but you don't have to. This is where I'm saying you're conflating two different things - QA and packaging are separate.

Please don't get me wrong, I love debian and they do an incredible service to the Linux community with their testing. But why force it all on users that just want to build a simple package instead of doing make install as root?

Again, QA is part of Debian packaging (just check all the debian lintian checks https://lintian.debian.org/tags-all.html - and you do officially run lintian on your packages).

Again, no one is forcing you to do official Debian packaging if you want to create simple deb for your purposes and it was mentioned in this thread by other and me several times (and several tools).

Reply on news.ycombinator.com