Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 26, 2011 9:52 UTC (Wed) by rahulsundaram (subscriber, #21946)
In reply to: Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration by xav
Parent article: Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Clicking on a web page doesn't fundamentally change the process. It can just be a call to a repository. Besides, it is illusion to think that end users, especially desktop users just stick with the apps in the repository or that a single repository can provide everything a user wants. There are tons of apps or apps in the version that users want that are outside any mainstream Linux distribution repository. They go click and add random repositories all the time and that is really no different than clicking a random web page to install a app. If desktop Linux becomes mainstream, we are going to have to tackle the malware problem differently than trying to enforce a one repository rule.

Let's look at one aspect of the problem with the current model: If Firefox 4 releases tomorrow and I am using Windows or Mac OS X, I can install it immediately and in Linux, one usually has to upgrade their entire distribution. In Linux, there is no fundamental differentiation between system packages and even leaf applications. This is a problem that one has to solve and the current methods are awfully weak. The system admin point of view is great for servers but desktops need a different solution.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 26, 2011 10:08 UTC (Wed) by niner (subscriber, #26151) [Link] (1 responses)

What you describe already exists. It's openSUSE's One-click-install. You click a link and the handler subscribes you to the repository and installs the requested package along with it's dependencies. You can then select if you want to stay subscribed to that repository to for example receive future updates.

Makes staying up to date with for example Firefox trivial.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 26, 2011 10:36 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link]

I am aware of openSUSE's solution as well as others like Ubuntu's PPA etc but it has to be available for more than just one distribution. That is sort of the point of getting the different distributions together and hash out the problems and solutions.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 26, 2011 11:41 UTC (Wed) by nicooo (guest, #69134) [Link] (1 responses)

>Let's look at one aspect of the problem with the current model: If Firefox 4 releases tomorrow and I am using Windows or Mac OS X, I can install it immediately and in Linux, one usually has to upgrade their entire distribution.

Which model are you referring to? I'm using gentoo and this works fine. The nice thing about distributions is that there are different models.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 26, 2011 12:15 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link]

It thought it was obvious that I was referring to the mainstream distributions that are part of the discussion in the article. The problem with the different models is that it very much a pick your poison kind of thing. Gentoo isn't something one would recommend even if the users like having the latest applications.

one-click third-party software installs

Posted Jan 26, 2011 21:10 UTC (Wed) by jthill (subscriber, #56558) [Link]

I think it's plain this notion produces exactly the same sequence as what produces the Windows nightmare: anyone can construct a web page or email and put anything at all at the fetch URL. No.

Clicking on a web-page does fundamentally change the process. It's a little weird to newbies. It takes manually fiddling with system files, unless somebody's already made an update-sources.list protocol. imho that's just barely enough to stave off the Windows nightmare now.

Because installing third party software with apt means running root scripts directly from whatever's behind the flashy link, does it not?

I think a third-party install scheme that protects the system and the user has to be cooked up before considering this.

Say, for third-party-signed packages create a new user/group combo, that can be tied to an "origin" key that must also have signed the package-signing key. For unsigned packags just use "nobody" or "third-party" or something, they don't care enough they can go in the swamp.

Something to that effect, for sure:: you want to also protect these packages from each other.

Run the package scripts on the package's userid, with a special service to install links into the system hierarchy. Apps will also want some writable .config or .local or whatever it is now subdirectory, also prompt users to grant access. Put the app's per-user config one level down, .config/example/example-config, so metadata is inaccessible to the app. Log a copy of the outside-/opt actions to syslog, and show them to the user in like a three line text box with a that's all indicator. Offer "here's what's installed on your system. I've logged it to syslog. Want a copy?" <Save install log> <Thanks, I'm good>.

The access restrictions will stop most if not all of the Windows uninstall nightmare. Say add a product key in addition to the package key, then tag the directories with the responsible key. .config/opt/foo/.PRODUCT_ID_fingerprint doesn't match any installed package's fingerprint? It's stale. Make the tag file owned by root, the product's group, 744 so the user and app can verify, another service to update contents from newly-installed packages from the same origin. That's easily subvertible by the user

That, or convert everyone to kerberos...

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 27, 2011 0:17 UTC (Thu) by garloff (subscriber, #319) [Link] (3 responses)

> If Firefox 4 releases tomorrow and I am using Windows or Mac OS X, I can
> install it immediately and in Linux, one usually has to upgrade their
> entire distribution.

You happen to not have spotted openSUSE Build Service yet.
It's dead simple to build packages for various distributions that you can simply drop in to older distros.

The main limiting factor here is that once you build on newer shared
infrastructure it becomes more tedious ... but the FFox4 example is one
where this works rather easily.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 27, 2011 0:23 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

I am aware of that as I have already indicated before but If I am a end user, I don't want to be building packages in any build service. That's just ridiculous. If it is not in my distribution repository then I just want to install Firefox 4 from a obvious place. mozilla.org would the most obvious location.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 27, 2011 0:27 UTC (Thu) by garloff (subscriber, #319) [Link] (1 responses)

Well, I don't suggest end users should build most of their software themselves. But someone can do it. Most obvious choice would be the
upstream community itself.

Untz: Results of the App Installer meeting, and some thoughts on cross-distro collaboration

Posted Jan 27, 2011 1:57 UTC (Thu) by vonbrand (subscriber, #4458) [Link]

Upstream has enough work cut out for them just getting the base to work (and fix bugs), asking them to also track whatever a few hundred (eo even just a dozen "mainstream") distributions are up to is just over the top.