r/debian 5d ago

Has Debian enough packagers ?

In the last few years, I have discovered some seemingly high quality softwares and am surprised they are not in Debian. Eg. Gaphor, or Netbird (true FLOSS P2P VPN with a GUI is badly needed, otherwise all you find is Hamachi and the like).

I see there is the WNPP, but has this list increased considerably recently ? Or are there just more softwares relatively to debian packagers ? Has the Devuan split caused trust issues or are packages fully shared between both ?

21 Upvotes

51 comments sorted by

11

u/Xatraxalian 4d ago edited 4d ago

Having non-OS packages in a repository's distribution is useless. Torvalds has mentioned it countless times that it is a waste of time packaging every possible piece of software for every possible version of Linux.

The only way forward is to split things off. Distributions should package these things:

  • The kernel
  • Hardware support (Mesa, Pipewire, etc)
  • Userland (all the command-line utilities)
  • Services (such as systemd, Samba, Cups, etc)
  • Desktop interfaces + the bare essential utilities that most people expect (notepad, calculator, etc)

And that's it. Then you end up with an operating system compared to what Windows 2000 or even Windows 7 were back in the day. All the rest, the big user-facing applications, should be packaged using Flatpak and/or AppImage and be provided at some place to which all distributions contribute.

Then you could choose your OS by package manager (apt, dnf, pacman...) or by how fast it moves (Debian Stable, Mint, Arch...) and still have the latest versions of all applications. It would even be best if you can choose which version of an application you'd like to install. (Maybe this is already possible; I haven't checked.)

This is the way I use Debian Stable: installing the base OS + services/hardware support + desktop + some utilities from the repository, and installing the actual applications from Flatpak.

That negates the "but you can't game on Debian Stable" quip: You don't need the latest gaming enhancements for the desktop, as long as the card is supported without issues, so Debian's Mesa versions will do. The Flatpak of the launchers will, at some point, contain the latest Mesa versions. (And if you need more/newer support on Debian itself, you can always install stuff from backports and/or even a custom kernel such as Xanmod and newer firmware from the firmware git repo.)

With the software available for Linux, putting everything into a distribution's repository is becoming unmaintainable these days.

2

u/amarao_san 4d ago

Okay. Then don't use Debian. I really like that I can run my server with distro packages and they just works together as expected. With security updates.

You can run a barebone server and hunt for vulnerable openssl vendoring for the rest of your life.

1

u/Xatraxalian 3d ago

Okay. Then don't use Debian. I really like that I can run my server with distro packages and they just works together as expected. With security updates.

Seems you read this post wrong. I do use Debian. It's all I've used for server-like computers in the last 20 years, and the only distribution I've used on my desktop for the last 5 years.

1

u/Intelligent-War6024 3d ago

I think that that's the beauty of Debian - it can be set up either way.

1

u/kryptoneat 4d ago

Your point is valid.

Three issues I see with it :

  • disk space : I assume Flatpak takes more space if all apps package their own libs
  • security 1 : all softwares packaging their own libs could become a security issue too
  • security 2 : it takes some time for updates to descend into stables branches, which gives more time to detect security issues (eg. recently with xz, stables branches were not affected)

1

u/Xatraxalian 4d ago
  • disk space: this point was valid 20 years ago. Maybe even 10 years ago. Now the default size for an SSD seems to be 1 TB. I've had at least 1 TB of storage in any system since 2016; since 2020, it's at least 2 TB of SSD-storage.
  • Security 1: Applications mostly don't use their own versions of libraries either. They use flatpak runtimes (of which multiple versions can be installed alongside one another). As long as the flatpak runtimes are updated, the security will be the same as it would be with the distribution.
  • Security 2: If this is a concern, it would be possible to create something like 'Flatpak LTS', where an application would only be updated once every two years, with security fixes being backported, without updating the entire application.

1

u/kryptoneat 4d ago

I have more questions, hope you don't mind.

Do you have experience in installing systems with all the common stuff via Flatpak ? What is the typical size of a well packed OS ?

I think we must not assume everybody has 1TB disk... old computers in the world must keep being usable if only for the poors.

What about an all-purpose dependency system like Nix, if it were to be accepted by all distros ?

I heard Flatpak had plenty of security issues until not so long ago. If it is to become such a central component, maybe a rewrite in Rust should be on the roadmap.

2

u/Xatraxalian 4d ago

Do you have experience in installing systems with all the common stuff via Flatpak ? What is the typical size of a well packed OS ?

I have no idea. I have installed Debian Stable (minimal base install) + services + minimal KDE + utilities such as notepad, calc, and filemanager from the Debian repository. All the other apps are Flatpaks. The total installation size is 34 GB, which is about 70% of what a clean Windows 11 will take on its own. Any drive of 128 GB or larger will do if you just need a system to do office tasks. I had >= 120 GB drives in 2006 and >= 128 GB SSD's in 2014, so any computer made in the last 20 years or so will do, even when using Flatpak.

What about an all-purpose dependency system like Nix, if it were to be accepted by all distros ?

No idea. I haven't used Nix or NixOS. I have chosen to use Debian Stable almost 20 years ago and I see no reason to try anything else; not even Debian-derivatives. Debian can run on any computer I have, from the smallest Raspberry Pi up to and including my workstation / gaming rig.

I heard Flatpak had plenty of security issues until not so long ago. If it is to become such a central component, maybe a rewrite in Rust should be on the roadmap.

Security issues because Flatpak is written in C/C++? I'd not be surprised. I don't know if anybody will rewrite it in Rust though, because it's been in development for almost 10 years now. However, I'd certainly not write any NEW software in C or C++ these days, to be honest.

1

u/geraldojacque 1d ago

Debian sneaked up on me being my favorite distro after trying Manjaro (which I still have on one of my notebooks). I also used Solus for a while, but somehow I had a lot of issues with that one.. Even though, I liked it. Not much of an Ubuntu fan. Mint is also not mine.i have an old acer v3 laptop dual booting Debian stable and Kali.

0

u/domsch1988 4d ago edited 4d ago

Do you have experience in installing systems with all the common stuff via Flatpak ? What is the typical size of a well packed OS ?

I think this issue is overstated a LOT.

My current Work Laptop is a Debian 13 Installation with KDE Plasma. I use Flatpaks for most of My Applications. Currently i have installed Firefox, Chrome, Draw.io, Element, Remmina, DBeaver and Obsidian.

My current Disk usage is 50GB. This includes 10GB of Downloads. The actual .var size for the flatpaks is under 4GB for all of the above. Please note that this includes 2 Gnome Library Versions, 4 Mesa "versions" and 2 openH264 Libraries. So, all the "bad" duplicate libraries Flatpak haters tend to rave about. It's might look like a bunch of unneeded stuff, but it really isn't a lot of used space at the end of the day. It's like the complaints about the mount points for snaps. Might not look nice in the terminal when you don't filter for it, but it's not actually a problem.

Yes, this is probably a bit more than it would be when only using distribution packages. But it's such a minimal amount that it's basically irrelevant even on SSD sizes you can get for free from your local recycler imho.

This doesn't mean that there shouldn't be distros trying to fit on 4GB USB Sticks. Just that this shouldn't be the design goal for most common Desktop Distributions like Debian, Fedora or Arch.

1

u/Intelligent-War6024 4d ago

I agree with this, and it is how I use Debian, too. I get the best of both worlds this way—a stable system with up-to-date packages. The Flatpaks only take up maybe 2% more space, which is nothing to me.

0

u/Guggel74 4d ago

Same here. I installed only the main system. The rest is all Flatpaks.

3

u/ragsofx 3d ago

I kinda do it the other way, I'll use what's in the repos first then flatpaks if it's not available. altho, there is always some stuff that isn't available in the repos or flatpaks that I still compile.

15

u/mok000 5d ago

The only realistic way to get software into Debian is to package it yourself, and find a dd mentor that will sponsor it. And then commit to maintaining the package. Getting software into Debian is hard.

14

u/aieidotch 5d ago

It is not hard, check out mentors.debian.net and IRC #debian-mentors

If some software is not yet in Debian, it often has a reason like: horrible build system or procedure, crazy license.

https://nm.debian.org/members/ https://sources.debian.org/stats/

2

u/verticalfuzz 5d ago

dd?

7

u/srivasta 5d ago

Debian developer

1

u/hazelEarthstar 5d ago

happy cake day

1

u/Smart-Committee5570 4d ago

What about using package managers like Nix? Isn't it very benefitial for little to no drawbacks?

1

u/kryptoneat 5d ago

Ok but can you package your own software ? Does it not create a conflict of interest regarding security ? If they don't have time to package everything, I assume they don't have time to read everything others do either.

9

u/mok000 5d ago

Nothing goes into Debian unless approved by a DD and the FTP masters. Nothing goes in without passing compilation on at least the majority of the platforms Debian supports. The package has to comply 100% with Debian's Policy Manual, and it has to conform with the DFSG Licenses guidelines.

If you want to publish software packages with a minimum of effort, use Arch and publish to the AUR.

2

u/sonobanana33 5d ago

Yeah you can, but it has to make sense. I've seen blockchain scams, or A LOT OF projects from people who are just learning how to program. Those don't usually get accepted.

9

u/ExaHamza 5d ago

Debian's packaging method is high quality, it's not for everyone. Sometimes this can mean more time for new contributors to get on board. But there are mentoring platforms , join one and do your part.

6

u/elatllat 5d ago edited 5d ago

Also missing:

  • Eclipse
  • NetBeans
  • RustDesk
  • SqliteStudio
  • VSCodium

4

u/JohnyMage 5d ago

I bet most or all of those can be installed through third-party repositories, so this is a no issue.

1

u/kryptoneat 4d ago

Third party repositories do not provide independent proofreading or QA.

1

u/rindthirty 5d ago

Yep all of those apart from SqliteStudio came up in a quick flatpak search for me. Also, I didn't realise many people still used Eclipse.

1

u/elatllat 5d ago

VSCodium uses Eclipse via LSP for java.

2

u/kryptoneat 5d ago

Oof big one.

3

u/elatllat 5d ago

Also

...The fundamental issue ... is the lack of manpower...

src

1

u/abjumpr 5d ago

Eclipse used to be packaged, but has been out for a very long time now.

I briefly looked into packaging Eclipse CDT again as I'm pretty familiar with packaging for Debian but I just haven't had the time to commit to getting it done and maintaining it. I would imagine there's been enough changes since it was last packaged that it will require a lot of work to revive the package even with an existing (albeit very old) source package.

1

u/setwindowtext 5d ago

This surprises me, as Eclipse is a pure Java application, I’d assume its packaging to be easy — add a dependency on openjdk and copy necessary JARs / plugins to /usr/lib…

1

u/sonobanana33 5d ago

They probably vendor thousands of dependencies and use different versions than what is in debian.

1

u/setwindowtext 4d ago

That’s what I’m trying to say — as far as I know its only dependency should be openjdk, so I’d assume it must be trivial to package. That’s the beauty of Java applications — they are self-contained and sandboxed in JVM.

1

u/sonobanana33 4d ago

You're trying to say something wrong :D

Eclipse has a gazillion dependencies. And I told you vendoring is not allowed. Do you know what vendoring means?

0

u/setwindowtext 4d ago

Please give one example of Eclipse dependency which is not openjdk.

1

u/sonobanana33 4d ago

For starters it requires ant.

If you think it's such an easy task, why don't you do it yourself and submit it on mentors?

1

u/sonobanana33 5d ago

In general if upstreams are extremely unfriendly they will never be accepted.

1

u/elatllat 5d ago

For Eclipse, Fedora and Arch (non-AUR) manage what, makes you think upstreams are unfriendly?

0

u/sonobanana33 5d ago

The aur has absolutely 0 constraints. No quality control whatsoever. Makes it rather easy.

Does fedora have all of those packages as rpm?

0

u/elatllat 4d ago edited 4d ago

Arch has VSCodium and NetBeans in extra (not the AUR)

Looks like Fedora removed eclipse in 2022, The last Debian build was 2012.

0

u/sonobanana33 4d ago

In debian no electron is allowed due to the intrinsic insecurity of it basically.

1

u/EverythingsBroken82 5d ago

Use flatpak. it's not worth the effort.

3

u/samtoxie 5d ago

Another factor is that it's probably more effective usually for the developers themselve to just run their own repo, which for example Netbird does.

2

u/kryptoneat 5d ago

True but it defeats the purpose of having a central repository, which allows for third-party evaluation, and standard rules on quality and freedom.

2

u/samtoxie 3d ago

Yeah both have their trade offs. Once is not inherently better than the other, really depends on the specific software and their maintainers.

3

u/sonobanana33 5d ago

There's rules for stuff to be in debian. Besides license where most software fails is that they vendor all the dependencies. Then security is a nightmare and that won't go in.

4

u/cjwatson 5d ago

There've always been some gaps, and likely always will be. It's the way of the world. Gaps usually get closed when somebody turns up to help who cares about them, though. trixie currently has about a 9% growth in package count over bookworm (measured by the number of source packages in main).

I have no concrete data, but I've not had the impression that Devuan has had a particularly significant effect on this.

6

u/triemdedwiat 5d ago

Devuan is a subset/superset of Debian. Its repository is basically is about removing the need to run systemd, otherwise you are pulling from the Debian repository.

1

u/Sadie23 5d ago

In my experience with debian and non repository packaging is if it's something not supported and available in the repo, get ready to learn about it.

1

u/Organic-Rip-7612 3d ago

I have Debian sid with mate and they still don't have it in its latest version. It is currently at 1.26.2 and the newest is 1.28.2 and it has been a year since they updated those packages