DUR: The Debian User Repository
dur.hunterwittenborn.com
dur.hunterwittenborn.com
* It's so much harder to build your own software packages on Debian. Even patching an existing Debian package can be painful, and having to write your own packages is even worse. I'm sure a dedicated enough user can learn to use the Debian packaging software proficiently, but it's a huge barrier to entry when I have something as easy as Arch's PKGBUILD syntax at my disposal. It looks like this project is interested in solving this problem: rather than using Debian's packaging tools for the DUR, it actually appears to literally be using makepkg with a Debian conversion script running on top. [1]
* The systemd integration is currently quite bad. It's probably the source of a bunch of user complaints about systemd. Debian's systemd install currently still supports [2] and uses init scripts and update-rc.d, the very thing unit files were supposed to take us beyond. In fact, a pretty minimal Debian installation I have on a server has 14 init scripts, while my Arch install doesn't even have an /etc/init.d directory! On the whole, Debian administration is a lot more complicated than on Arch because of the relative complexity of the architecture.
I can't say that's been my experience, once I figured out dh_make [0] that made it pretty easy by handling most of the boilerplate. Building an existing package is as simple as doing `apt source` and then `dpkg-buildpackage` to rebuild it (you may have to do `apt build-dep` first too). I agree with the rest of your comments though.
Edit: I haven't looked into the details of how it works but I would imagine that YMMV with trying to use makepkg that way. The hard part here isn't getting the packages to build, it's in reconciling the library dependencies across all the tens of thousands of packages that make up both distros.
[0]: https://blog.packagecloud.io/eng/2015/07/14/using-dh-make-to...
That's the whole point. Nobody doubts that the Debian tooling works (it evidently does), but the learning curve to get to that point is massively steeper and longer.
Makepkg you can figure out in an hour, at most an afternoon for the finer details like custom patches; reliable Debian packaging takes days or weeks to understand set up.
Recreating the patched packages and setting up my own PPA for them was pretty much trivial. It did not take a whole day to figure out.
The Debian system is a little clunky, but it is not hard. If you're a user of Ubuntu or Fedora or openSUSE whatever, learning how to create DEB and RPM source packages and upload them to OBS or Launchpad is way less work than setting up Arch for the first time.
Personally, I think the approach that upstream Debian uses in order to not include the headers of libraries with the binary builds is wrong.
Nobody has time to deal with over 30 GIGAbytes of hard drive memory that is just there because I wanted to rebuild a damn library of 20kB. That is a total fail, architecture- and build-system wise.
As long as Debian separates between distributed binaries, and -dev packages which include all source codes and headers - I would not recommend it for software development.
This is the exact reason of PPA fatigue, where end users have sometimes dozens of versions of the same library installed that is also an absolute security nightmare to begin with.
Reproducible builds are worth nothing if everybody has to use a PPA of some random untrusted blog post on the internet (omgubuntu anyone?) because Debian's packages are too outdated. Usually those PPAs are heavily outdated as they are built once and then abandoned for years.
Libraries are not upgradeable due to how other packages depend on them. They cannot be rebuilt without having to rebuild the whole operating system (have to rebuild X again? Well, gonna stop here then.)
Sorry for the rant, but I think in order for DUR to work in practice, these conceptual flaws have to be fixed upstream first.
Is that the case for some specific languages? -dev packages for C and other compiled libraries do not include the full source code of the library. Normally they only include the headers, pkgconfig, and similar files.
> Libraries are not upgradeable due to how other packages depend on them.
Got some examples where it's a problem and not an actual dependency issue?
Try to recompile mesa or say, just the demos (aka glxgears) :) Worst case scenario for Debian dependencies.
Header files are literally less than a couple kB per package, and Megabyte-sized headers are the exception for huge frameworks like QT or GACL. Arch packages don't ship the source codes, only the binaries (.so files) and headers (.h files).
Overall, the /usr/include folder on my system has less than 230MB, which is a damn lot because I have all kinds of compilers, programming languages and libraries installed. I even have 32Bit and atmel libraries installed because I do embedded reverse engineering and cross-compiling development on other architectures; so I also have gcc, LLVM, rust, go, C/C++ and other programming languages and their dependencies installed. So it's very likely much less than that for others.
If you cannot afford that, you should maybe choose another, smaller, distribution like "Damn Small Linux", Alpine or similar. Debian wouldn't be a good choice for that matter anyways.
Neither do Debian's -dev packages.
Multi-stage builds do make it a bit easier to get rid of them for containers, yes, but during the build stage it's still required.
Absolutely, it's negligible - because the space consumption of header files is also negligible. It's such a bizarre design choice to split out a single 30 line .h file into a separate package.
I'm not sure what you mean 30 GB of memory. How is that related? And how would merging the -dev packages into the library packages solve it? IMO there are problems with the Debian approach but I wouldn't say that's one of them -- a worse problem to me is that things like cross-compiling/multi-arch mostly requires chrooting which is a lot less convenient than the approach used by something like Nix.
I started with Debian (not as a packager, but just as a technical user who occasionally wants to do his own stuff). Years later I was forced to use rpm and was suprised that things could be so straight-forward. Yet years later I was forced to look at Arch and was suprised again: Hey, you can understand all of it just in a couple of hours.
Accumulated experience might result in a slightly biased perception. But I still believe the described gradient exists.
A well-written tutorial will explain that to you quickly, but there's definitely more friction than with PKGBUILD files where you can pretty much just look at the contents of the file and edit it directly without second thoughts.
But in any case it's never been as easy as just running that one command for me. Actual example from my bash history:
$ apt source packagename
$ vim path/to/broken/file.c
$ dpkg-buildpackage
$ dpkg-source --commit
$ dpkg-buildpackage
If you know what you're doing you realize that you can just ignore this error, it doesn't affect the built package. If you don't, you have to search around and then build it again with
$ dpkg-buildpackage -uc
I haven't used plain Debian, but this has been my experience with Ubuntu. Almost all the problems I've run into with systemd have been because of an interaction with init.d scripts that should be systemd units, or similar. My biggest complaint is that while systemd-resolved is supposed to be optional, on Ubuntu it is practically impossible to fully disable without breaking things, and disabling is officially "unsupported". On archlinux, if you want to use dnsmasq instead it is just a matter of disabling one service and enabling the other.
Thing is, I'd only want such an install for playing around with occasionally and as the argument upthread makes pretty clear, "doing a bulk upgrade occasionally" is something that really isn't regarded as a sensible way to run arch.
Partial updates are also unsupported, and in my experience that's the most common way people break things.
First time around I was just getting up and running and as I installed python3 there was some mismatch between some very core libraries and I couldn't roll back since the library in question wasn't available anywhere, but python3 package (or something that came along with it) was linked against the old one. Only "work around" I found was to symlink the current lib to the old's path.
Second time I just just running bog standard fetch & update. Then I rebooted as is normal after you update and it no longer booted.
Arch is fine hobbyist distro and you for sure have to live on he edge, but I wouldn't use it for anything you expect to be able to use every day at a moments notice.
I disagree 100%. This laptop I'm typing from now was installed 2014-07-06, it's my main personal machine with all the random things your typical desktop does and it works great. I similarly used a work laptop almost as long until I was forced off Arch for compliance reasons this year (sigh). Your anecdotal failures are not everyone's experience, definitely not mine.
First of all how are these MY failures and not failures of the Arch ecosystem? Running `pacman -Syu` on any given Friday should NOT leave you with a machine that no longer boots. Installing a very stable software such as fucking python3 shouldn't break litereally everything else that is linked to same lib. Everything is anecdotal, but trying to use that to dimiss literally OS breaking incidents feels silly.
If I type in `apt update && apt update -y` I can be sure that my computer will be usable after a reboot. I've once ran into an issue where the next kernel update didn't boot, so Ubuntu booted me back into the previous version and told me the issue. This is exactly the kind of thing I want my OS to protect me from. I am not a kernel developer and don't have sufficient knowledge or interest to get into that. I also don't want to be afraid to update my software.
I have nothing against Arch or its users, but I wouldn't recommend it to anyone who actually needs to use their computer and isn't willing to spend a day every now and then fixing their OS.
Just as a side note on this rant: My experience is by no means unique. The whole reason I even gave Arch a second try (after the python3 library ordeal) was that my colleagues are using Arch as their daily driver, but even with them every now and then I hear how they have to fiddle with their packages to make things work/compile or that they updated something and something broke (often it is audio).
Says who? That's pretty much not what Arch tries to guarantee at all. You're at the very least supposed to read the announcements and you should upgrade often, as otherwise the end result is undefined. Some distros like Debian support partial updates, Arch very explicitly does not.
If you use Arch the way it's intended to be used, you're not going to have to spend a day every now and then to fix your OS, but if you don't, you will. I use it as my work system for years and every time I broke it was my own fault.
And if you don't want to use it the way it's intended, then just use another OS that better matches your expectations. I don't use Arch on my server after all.
>you should upgrade often
But you litereally started by saying that upgrading any given Friday is not quranteed to leave you with working OS
To give a practical example. In 2013 Arch Linux merged all binaries into /usr/bin. This architectural improvement was obviously a major change, and the way Arch is designed as a rolling distro meant that you couldn't leave users behind on the old way of doing things. After the change, everyone needed to be using the merged /usr/bin.
This is a designed lack of backwards compatibility that means you're guaranteed to be using the latest system architecture at all times, reducing the maintenance burden for the maintainers and making sure everything just works most of the time. But it also means that you have to be willing to do system maintenance to get your local system in line with what the Arch devs use. In the case of the /usr/bin merge, manual steps to perform the upgrade were required. [1] They weren't hard, but Arch requires this kind of oversight as part of its design.
If you're not willing to perform that kind of maintenance, then Do Not Use Arch! It's designed for people who are - although in practice this kind of intervention is required only about once a year.
[1]https://archlinux.org/news/binaries-move-to-usrbin-requiring...
Not "if it's ok to update", but "whether there's manual intervention required". See https://wiki.archlinux.org/title/General_recommendations#Pac.... Not reading that before upgrade seems to be the main reason for post-upgrade failures.
> But you litereally started by saying that upgrading any given Friday
The point was that you should rather upgrade "every Friday" than "any given Friday".
As from my other replies, that's awesome - you're looking for a usage paradigm that is not what Arch is for; it requires attention and regular maintenance, and "keeping up" on a regular basis. You've hit the nail on the head with the followup sentence, you have to be willing to spend a day every now and then keeping up.
Arch is not for people who want to ignore their system and hope it all just keeps working, then update 700 packages all at once and have it come crashing down. There is an agreement (the social kind, not the legal kind) you enter into when using Arch that you actually engage with it on a regular basis because you like doing that and like to tinker. It's build for experienced Linux techs who like to engage on a regular basis with the plumbing.
>It's build for experienced Linux techs who like to engage on a regular basis with the plumbing.
Yeah, sure. This is where the "Linux is only free if your time has no value" saying comes from. I think I've said this in all comments in the thread, but if it isn't abundantly clear anyone is free to use any distro they want or any OS for that matter (I use all major 3 almost daily), but I would not recommend anyone to use Arch unless they are willing to spend a lot of time fiddling with their machine and I wouldn't install it on anything that I might have to use at a moments notice since as I've been told part of Arch is that updating your packages just breaks your OS.
Yes, exactly right. As an Arch user, I endorse this.
It goes beyond anecdotal evidence. I mean, if you look at the Arch news feed[0], there are a good few updates since then that are labelled "requires manual intervention". I like Arch and it's great they're posting those notices, but I don't think it can be claimed that upgrading an on-the-edge system is always problem free.
That's by design. If you choose Arch as your system, you're agreeing to that (otherwise why would you choose it in the first place - that's a direct consequence of its value proposition). I'm not sure I would call that a "problem".
You absolutely ignored your Arch system for far too long and most likely missed important News notifications that manual actions were required, it happens now and again. With updating 700 packages at once you've just dug yourself a hole - Arch is not a system you can ignore for that long, by design it's always changing to reflect the newest upstream changes to software. As I posted to the other person, if you want a distro to ignore over time then Arch is not for you.
Arch's demanding nature with respect to being routinely updated follows directly from the fact that its package manager is stateful and unsophisticated (e.g., its dependency resolver is incomplete (will fail even when solutions are available, because dependency resolution is NP-complete and 'gotta go fast')).
It's totally fair to call this an Arch/pacman defect. Part of it is also lack of enduring hacks like Debian and derivatives use (long-lived transitional packages), which is a choice by Arch developers. A glance at the online Arch package listing and some example .PKGINFO files indicates that Pacman also doesn't support metadata like 'provides' and 'replaces' in DEB and RPM, which means the developers have fewer tools at their disposal for dealing with transitions like that, even when they want to.
Clearly many users don't mind all these tradeoffs, but others who shy away from Arch after experiences like that mentioned in the GP comment are totally right, as a matter of fact, to blame the design of the package manager for their woes.
We're not looking at the price of bleeding edge packages or a rolling release. We're looking at the price of 'keep[ing] it simple, stupid'.
Edited to add: the existence of the DUR shows that Debian probably doesn't fall on the right side of the complexity tradeoff for the purpose of maximizing user contributions. The same users who contribute to it could also create their own Debian packages, but they don't, presumably in part because it seems harder to get into. (It's not that bad if you use debhelper, but it is also clearly a crufty system that has evolved this way and that over time.)
So Arch's philosophy also clearly has other strengths. But imo we shouldn't give it a pass on the kind of fragility outlined in the GP.
I guess this is what you get for making assumptions about a platform you're technically unfamiliar with, isn't it?
pacman and apt have a different feature-set. Handling a neglected system and recovering from terminated upgrade are explicitly not what pacman does. If you expect such features from your system, why did you install Arch in the first place?
Undeterred, I downloaded the latest ISO of Arch, reinstalled and updated it. Again unbootable. So rather than provide a working latest ISO that resolved a breaking glibc change they had introduced, there was a poorly communicated and (what I considered) fairly unclear set steps to upgrade the OS. I gave them a go, still broke.
I wasn't even that mad, but at that point I realised it just wasn't the OS for me.
I have had once a serious bug which rendered my computer unbootable, which i couldn't have solved without my fifteen something years career helping me. But it wasn't an arch issue, i would have had the same thing on debian.
I am currently back on ubuntu 20.04 and haven't had any issues
If I want to try running a Debian package with an experimental patch as a one-off, I haven't found it too hard to build my own version.
But AFAIK there's nothing that helps me manage the necessary work to rebuild with the same patch when a new distribution version comes along.
Do source-based distributions have a good solution for this?
This should be expected though. Debian has been around a lot longer and is depended on by more of the Linux world. Complexity is a natural outcome of more stakeholder requirements (more stakeholders = more requirements = more complexity).
I won't get into the systemd holy war, but suffice to say that comparing the architecture of init scripts vs systemd is like comparing the design of a bicycle to a car. One most definitely is more complex than the other, but whether that's a good thing or not depends on what you want to do with it.
I have no complaints about distros that are either 100% systemd or 100% init scripts. The problem with Debian (and its derivatives) is that they're trying to maintain both at the same time.
If they really want to support both "/etc/init.d/servicename start" and "systemctl start servicename" commands, one should be turned into an empty shell that simply invokes the other, like what Red Hat did with the "service" command. The current system kinda works out of the box, but goes out of sync as soon as you try to customize either the init script or the unit file.
Well said. I'd add that "service" is actually doubly confusing because the command was IIRC actually introduced by Ubuntu when they were doing Upstart, which was their own attempt an an init replacement. Ubuntu still has the service command, actually, and now it supposedly runs both init scripts and systemd units. I've never actually tried it because I'm rather spooked by having multiple mechanisms to activate a service. It still mostly has the upstart command syntax from what I can recall.
My Ubuntu server actually has a Upstart service file from one of the daemons I have installed, I only hope it's not somehow being activated or translated into an init script by some compatibility system Ubuntu has built in.
You might even be talking about RHEL 6, in which they used Upstart, and not whatever they're doing now. RHEL 6 is still under extended support, which means that there are still quite a lot of Upstart systems out there.
OTOH, I wouldn't be surprised if every other feasible approach's downsides are widely regarded to be worse.
Software. Yay :D
On a side note, I keep thinking there are so many great ideas spread over the many Linux distributions and not having a single joint effort makes it hard from an adoption point. I love having choice but I would really like more users to be able to use a (any) distribution.
Many packages are compiled from source rather than using prebuilt binaries, but when binaries are fetched it is something you'd see in the PKGBUILD itself. The binaries aren't included in the AUR itself, they'd usually be from the first-party of the software you're installing. For example google-chrome[1]'s package fetches the .deb from Google's server and unpacks it
[1]: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=googl...
The 20% side of this is yes, there are some prebuilt binaries in AUR - usually because (a) they are vendor proprietary code with no source (Zoom, for example) or (b) so insane to build that the vendor does it and you use their binaries (Firefox for example - it's a monster to compile). Most of the time these packages are clearly labeled, usually with "-bin" in the name so you can easily avoid them.
You are executing build instructions written by someone else, but the tools encourage you to actually review them (and pikaur for example can show them to you for review right then and there). There is a level of trust involved and yeah, bad actors do try and slip in ugly things but they're usually found pretty quickly because folks are actually reviewing-before-installing as encouraged. It's risk management on this one, you take some personal responsibility for using AUR to pay attention.
After getting that downloaded, compiled and installed then try a sample simple AUR package like "downgrade" - `pikaur -S downgrade` - to get feel for it. https://aur.archlinux.org/packages/downgrade/ It really is kinda that simple, the rest is just learning the basic "how are Arch packages actually made?" which is a good thing to learn in general.
`paru -Syu visual-studio-code-bin`
At home I've switched fully to NixOS.
It is 2021 and it still is a PITA to build custom Debian packages.
Debian is a rock solid distro and I think people would use it more if package management was better.
I don't understand what people expect to achieve by further fragmenting a minority OS that makes up only 3% of Desktop users.
- People have a fear or even aversion toward experiments since it needs effort, but some folks are simply geeks - they will keep trying and more power to them
- Some of these experiments, historically, have brought some of the best open innovations in the industry and moved even closed-source rooted companies to change mindset
- Fragmentation is a marketing problem IMHO and I would like to see some ground between that and a consolidated Linux distro but it will not happen easily and that is OK
- The enthusiasts like us do not need every other mainstream user on Linux but I am sure we would love that (I am a Linux user for 18 years)
- This community is happy learning and trying new things, it is joyful
So, more power to experimentors. The value of this community is in choice in a market that is dominated by the Apples and Microsofts who do not care about choice.
I really wish we could have an open-source OS that was reliable and user-friendly for consumers (especially given how user-hostile Windows has become in the last 5 years), while similarly being non-burdensome for devs to deploy software to (which, to be fair, has improved a lot recently thanks to AppImageKit et al).
For users, no. For devs, there absolutely is pressure to support and maintain multiple distribution methods for Linux users.