Packaging Kubernetes for Debian

Posted Nov 5, 2020 18:44 UTC (Thu) by smurf (subscriber, #17840)
In reply to: Packaging Kubernetes for Debian by Cyberax
Parent article: Packaging Kubernetes for Debian

> I have NEVER had an issue with Go's libraries breaking the ABI

That is by definition impossible, and IMHO it's anything but an advantage.
One of the major points of assembling a distribution is to have exactly one version of any library on the system, so that if there is an issue with any one of these libraries you update this exact library and majickally fix the issue for every program using them. Instead of, say, rebuilding and re-deploying ten Go programs.

And no, stability is not impossible. The package developer doesn't build the binary. The distro's build system does that, in a controlled environment.

> There are zero surprises.

There also are zero security bugfixes to any of the libraries you depend on. Thanks but no thanks.

Packaging Kubernetes for Debian

Posted Nov 5, 2020 20:34 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

> And no, stability is not impossible. The package developer doesn't build the binary. The distro's build system does that, in a controlled environment.
Distros do almost exactly zero QA, though. So if anything is broken, it'll be discovered by users. This results in very slow moving "stable" distros as a result.

> There also are zero security bugfixes to any of the libraries you depend on. Thanks but no thanks.
Well, Go is fairly safe in itself so security fixes are fairly rare. When they do happen, you'll have to update dependent applications, it's true.

And having better tooling to do that would be great. Github has a proprietary thingie (Dependabot) for that, and OpenSource solution to do the same would be awesome.