LWN: Comments on "Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)"

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

CameronNemo — Fri, 21 Nov 2014 10:17:33 +0000

I am pretty sure that if the package is removed from the repo, the users that have already installed it will still have it installed. If you replace it with a blank package, they will get the update and there will be no security issues left.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

raven667 — Thu, 20 Nov 2014 01:29:07 +0000

> It really doesn’t matter (and it shouldn’t matter) whether the code is build in OBS, Koji, or straight on my installed system.

While sure, you can get the same result no mater how you build it, and a distro has the resources to build whatever custom system they want, for third party packagers it would be nice if they only had to deal with one standard build system across the major systems rather than one per distro (plus package format differences). if an upstream is going to package their software they have to learn DEB and RPM, OBS and Koji, etc. which is asking a lot, a lot more than most upstreams are really able to give. OBS seems the most featureful and mature of the systems in common use so it seems to be a reasonable choice as a standard to build toward.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

ceplm — Mon, 17 Nov 2014 22:23:59 +0000

I don't think working in the same building system achieves anything. It really doesn’t matter (and it shouldn’t matter) whether the code is build in OBS, Koji, or straight on my installed system. What does matter is willingness of upstream to cooperate with distributions packagers, accepting patches, and (especially) sticking to stable APIs. Unfortunately, concerning stable APIs, exactly people around PHP are usually the least to care about this. I have my own running into this issue at
http://thread.gmane.org/gmane.comp.kde.devel.owncloud/11452/

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

jospoortvliet — Sun, 16 Nov 2014 20:32:41 +0000

First, thanks for the work you do. I am aware of the cross-distribution collaboration, esp between fedora and openSUSE.

I wouldn't suggest to build fedora with OBS either. What I do suggest is to have an OBS instance running where upstream can collaborate with downstream on building and maintaining packages. You thus share the work load, can always see what is going on and users can now trust BOTH their ISV and the distro people to protect them.

This model is technically possible and seems, to me, a very usable solution where both cakes are preserved. But I am not a packager and can't judge this entirely of course, so perhaps there are problems I am not aware off. Still, this model works great for software development (eg github) so I think it would be worth trying.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mathstuf — Tue, 11 Nov 2014 20:45:52 +0000

I think the conversion on the ISS was a more recent thing (though there is really only 1 of it), but IIRC, there were issues moving to Windows 7 (I'm pretty sure Vista was skipped) related to licensing. Here's a 2013 article that mentions stability concerns, so maybe licensing wasn't everything:

[1]http://www.extremetech.com/extreme/155392-international-s...

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

justcs — Tue, 11 Nov 2014 16:45:36 +0000

Linux runs on a overwhelming majority of Supercomputers as well as desktops in the ISS.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

ceplm — Tue, 11 Nov 2014 10:30:28 +0000

Well, some other long term distributions are actually, you know, maintained. LTS doesn’t “let’s call this old pile of turd LTS, and try to attract enterprise users on it”. People who actually do pay for Linux, expect the provider to do something more than publish couple of security patches distributor collects from the upstream. Which is the reason I am very happy there was never Fedora LTS.

Yes, I do work for Red Hat, and no I don’t think RHEL is the biggest achievement of humanity, and yes I do like CentOS (which is IMHO free LTS distribution done right, i.e., somebody else does actual work).

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

eean — Mon, 10 Nov 2014 23:31:31 +0000

Or just don't package it at all and let upstream do it. Like they are already.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

Wol — Mon, 10 Nov 2014 21:58:22 +0000

So why is it that the majority of my support grief comes from one of two sources (usually both together :-) namely

1) Windows
2) Users who ring for support, and half way through telling them what to do the do the exact opposite!

Cheers,
Wol

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

Wol — Mon, 10 Nov 2014 21:55:34 +0000

> Even perlcleaner and python-updater are becoming increasingly unnecessary.

so when you really need them, they're buggy :-(

Case in point, my latest emerge upgrade crashed because of missing perl modules or something. So I ran perl-cleaner, which crashed because of screwed-up dependencies.

Okay, following the instructions provided with the mess cleaned up the mess, but it wasn't nice :-( It would be nice if things "Just Worked (tm)" :-)

Oh - and one other nice enhancement I'd like to see to portage - which would get rid of a lot of need for --backtrack and the like - is an option that told it NOT to abort on dependency conflicts, but just to drop conflicting packages and carry on. The number of times I've had to manually select a couple of packages from the world list to upgrade, rerun the world list, manually run a few more packages from the list, rinse and repeat, and suddenly the conflict goes away. If I could just tell it to "emerge what you can", it'd probably sort itself in a couple of goes.

Cheers,
Wol

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

epa — Mon, 10 Nov 2014 15:02:41 +0000

What is the value of maintaining this property: "the release pocket never changes post-release"? Why not allow it to change?

After all, the set of available software does change as some packages are removed, and if you just replace something with an empty package that is equivalent to removing it for all practical purposes.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

AdamW — Mon, 10 Nov 2014 08:15:28 +0000

As the Fedora and EPEL maintainer of OC:

I'm not sure technology is really the solution. It's not really difficult to follow how a given bit of software is built in the major distros. I mean, you can go to packages.debian.org and find all the necessary info on the Debian build, ditto packages.ubuntu.com for Ubuntu. For Fedora or SUSE or Mandriva or many other distros you can go check the package build out of an SCM. Packaging systems really aren't that complicated, I can follow the Debian build of OC fine though I've never built a Debian package in my life.

I think it's perfectly feasible for upstream and downstream to work together without any technology changes, all it takes is...for us to do it. I think the blog piece is an interesting one, but by considering mainly the Ubuntu situation it skews too negative. I'd say I and the Debian maintainer, for e.g., have a pretty healthy relationship with upstream - we hang out in #owncloud , we send patches upstream, we talk to you folks regularly, we update our packages pretty regularly (OK, it took me a bit to find time to bring EPEL up to speed, but it should be fine now).

I think it's a bit unfair to distros to say stuff like "distributions prefer to stay on their islands and ignore the problem". We each have our frustrations with each other, I can vent about sloppily bundled and under-documented dependencies for a while if you like ;) But just as we should recognize the realities of trying to maintain a large-scale project like OC maybe you can recognize that a major distro, especially one with well-established processes and tooling, is a big beast, it's an ocean liner, not a speedboat; distros are deeply, deeply tied to their package build systems and it's really not as simple as 'hey look, there's OBS over here, why not just build stuff with that instead?'

Distros can look finicky and old-school with our insistence on policies about source verification and bundled libraries and the integrity of the build chain and update policies and blah blah blah, but most of those things aren't just there to make things slower...

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

niner — Mon, 10 Nov 2014 06:43:59 +0000

Yes, that's true :)

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

dlang — Mon, 10 Nov 2014 01:48:48 +0000

It's pretty obvious that you haven't actually had to use the 'commercial' support.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

dlang — Mon, 10 Nov 2014 01:47:58 +0000

That's because distros gave up backporting 'fixes' for firefox a few years ago, and even on the 'stable' versions they just ship the current firefox release.

It became too hard to identify the difference between fixes and features and to extract one from the other (and keep doing so as change happened)

The good news is that the Firefox team has gotten pretty good at avoiding breaking things as they upgrade (not perfect, but pretty good)

Most programs actually upgrade pretty well, but there are a handful of high profile ones (Unity and Gnome among them) that are fare more intrusive with their updates, and these cause the users to be reluctant to just upgrade everything.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

rodgerd — Mon, 10 Nov 2014 00:34:48 +0000

And this whole comment - wilful ignorance, snottiness and all - is precisely why Linux is and will likely be forever irrelevant outside of embedded uses.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

NightMonkey — Sun, 09 Nov 2014 23:14:29 +0000

Are you talking about Gentoo? The aspect of Gentoo I like is that complex stuff just works, and is well managed. I stay out of the 'guts' much more often than I do with RedHat and descendants in common use cases. (I consider 'guts' to include things like YUM plugins (yum-priorities, etc.), required community repositories (hmm... which one is good *today*?), for example.)

To you other well-made point, yeah, screw tinkerers. They suck, and are sooooo unprofessional. Nothing good comes from tinkering. ;)

You lost me on how the Windows 7/Firefox/Python is relevant here? There's lots of other non-technical business decisions inside Microsoft that underpin the idea of different 'versions' of Windows and critical core libraries.

Cheers.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

gerdesj — Sun, 09 Nov 2014 23:11:43 +0000

"2) The revdep-rebuild approach to reverse dependency tracking means that you can't always see how big of a mess this will be until you are in the middle of it."

Like all systems, Gentoo is evolving and improving. revdep-rebuild is pretty much a thing of the past (barring bugs). Portage does it automatically nowadays.

Even perlcleaner and python-updater are becoming increasingly unnecessary.

I'm seeing much less breakage these days that needs serious thought to fix up and my last visit to the "tinderbox" or another box for a binary package to get out of a proper mess was a pretty long time ago.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

HenrikH — Sun, 09 Nov 2014 22:54:11 +0000

Well it works for Firefox, on my 14.04LTS I got v33 via normal apt-get update when it was released by Mozilla. So some packages get new versions even in LTS.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

rodgerd — Sun, 09 Nov 2014 21:15:26 +0000

For a tinkerer, perhaps. But it's completely useless for an audience who don't want to spend their lives in the guts of their distro.

Whereas someone running, say, Windows 7 (because they don't want to touch 8) can trivially use the latest Firefox and Python while remaining on Office 2010.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

niner — Sun, 09 Nov 2014 15:12:20 +0000

That's about security updates which is not the same as supported as in 'I have a problem and I can call my support contact and get some help'.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

raven667 — Sun, 09 Nov 2014 14:49:08 +0000

Yes, that is one of the reasons they were using btrfs, the distro can serialize delta updates of the whole file system for efficiently patching.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

hkario — Sun, 09 Nov 2014 13:12:46 +0000

Lennart approach still requires /somebody/ to update the packages in base image when (not if) there are security issues in core libraries and then the users needs to know that he or she has to update the base image... - from security PoV that's unworkable

and if you don't care for security - just don't update at all, the software will continue to work

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

hkario — Sun, 09 Nov 2014 13:07:39 +0000

even on Red Hat Enterprise Linux the NSS cryptographic library (the one Firefox uses) is rebased regularly - RHEL 5, released in 2007, has NSS from this year. Firefox is also updated to current ESR version (soon to be FF31)

sure, those are exceptions, but for some packages are necessary - either you have to commit to backport the fixes yourself or you're at the mercy of upstream, there's no 3rd option

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

tterribe — Sun, 09 Nov 2014 12:32:11 +0000

Gentoo has a couple of problems.

1) They are way too aggressive about removing packages from the repository. This often leads to situations where upgrading/installing something pulls in a dependency that's so new it forces upgrades of 50 other packages (and then the process repeats), even though an older version of the package that's been removed from the tree would have avoided the problem.

2) The revdep-rebuild approach to reverse dependency tracking means that you can't always see how big of a mess this will be until you are in the middle of it.

However, if you're willing to pull old packages out of Gentoo's CVS and stick them in a local overlay, you can quite reasonably do what you want here. It just requires a bit more manual effort than it should.

You also run into the general problem that the dependency information in the packages is not always ideal, simply because very few people are testing very new packages in combination with very old ones, so sometimes things get missed (e.g., foo-2.3 requires >=libbar-1.2, but there were no versions of libbar older than 1.2 in the tree when foo-2.3 was packaged, so nobody remembered to update the rule).

But I will say that I have run into similar problems with every distro I've used, and Gentoo is the only one where I have been able to sit down and reasonably solve such problems, every time, in less time than it would have taken to just give up and re-image the OS with the latest Fedora release or whatever.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

dlang — Sun, 09 Nov 2014 11:24:00 +0000

what do you consider commercial support?

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

stefanor — Sun, 09 Nov 2014 09:27:44 +0000

Yeah, fair enough. You would know this better than I would.

Maybe I'm conflating commercial support with security support, in my mind.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mjblenner — Sun, 09 Nov 2014 01:37:18 +0000

> Even Google does not list Ubuntu in it's distribution drop down for it's cloud [1].

Maybe, but it's an option:

https://cloud.google.com/compute/docs/operating-systems#u...

And I think you misunderstand 'paid'. I read it as saying you can't use those OS's without paying, not that you get more support.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

NightMonkey — Sun, 09 Nov 2014 00:04:46 +0000

Gentoo pretty much offers what you seem to be seeking. YMMV.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

xxiao — Sat, 08 Nov 2014 23:39:41 +0000

Indeed different repos are needed in this case, e.g. put owncloud to a "volatile" repo together with similar projects.

redmine is another example, the version in ubuntu/debian is ages behind the newer ones, they should be put into a different repo instead, another example is drupal.

Then you do have the dependencies issues such as ruby versions or php/python versions used by these projects, but I think that can be addressed by installing different language versions and libraries in parallel in the same distro.

The stable release of distributions should separate packages into a stable repo and volatile ones carefully at the top layer, then you add those sub-repos underneath of each repo(security repo, third-party repo, etc).

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

jospoortvliet — Sat, 08 Nov 2014 22:56:33 +0000

First of all, we don't use suse factory - the openSUSE development tree is something we build packages against, but that is entirely separate from other packages. We use the open Build Service, which is a distribution agnostic build server - even our Windows packages are build on it.

Ideally, distributions like Debian would run their own OBS instance which could connect to ours so we would be able to work directly with Debian packagers (without having to leave our own infrastructure!) on bringing the packages up to spec. This provides great transparency and all the benefits of the current distribution model without the downsides caused by the balkanization the distributions have caused.

It is rather sad that all the technology is there but distributions prefer to stay on their islands and ignore the problem. And even bark at isv/open source projects occasionally for not helping the packagers. Wow, that surprises you? Get your act together and it becomes not only feasible but easy to collaborate!

I get why it is: nobody's itch needs scratching urgent enough. This harms isv's/foss projects writing software most and they focus on writing software, not starting projects in distributions to fix their problems.

Anyway. We did a bit of a write-ups on the issue on planet ownCloud, feel free to debate here or there. But please don't blame us for the fact that distributions fail to step over their own shadow and adopt (even just as an interface) technology that could improve this situation.

http://owncloud.org/blog/linux-distributions-and-open-sou...

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

drag — Sat, 08 Nov 2014 19:22:11 +0000

Yes. Definately software collections is something I am interested in. However it's probably Lennart's solution that has the best long-term process.

Software should really be built and packaged by upstream in most cases, except for lower-level OS stuff. It would be, in my more perfect world, be the job of the distributions to help upstream do this and make it as easy as possible.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

rahulsundaram — Sat, 08 Nov 2014 17:34:12 +0000

Software collections does some of this

https://www.softwarecollections.org/en/

Also NixOS and Lennart's

http://0pointer.net/blog/revisiting-how-we-put-together-l...

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

drag — Sat, 08 Nov 2014 16:47:38 +0000

Wouldn't it be nice if it was possible in Linux to do things like 'Install _THIS_ version of Firefox' or '_THIS_ version of OpenCloud'?

That way Linux users could, you know, update the version of Gimp or OpenOffice they are using without having to reinstall the entire operating system (or upgrade it, which is often worse experience).

Of course it does if you completely ignore the traditional Linux software distribution model.

To bad very few distros are working on making installing and maintaining arbitrary software easy.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mdeslaur — Sat, 08 Nov 2014 16:43:36 +0000

> Partly because the main/universe split still *mostly* aligns with support, just not entirely.

If it doesn't align, it's a bug in the seeds that generate the supported field. The field isn't really use anymore anyway since we aligned desktop and server support periods to 5 years in Ubuntu 12.04 LTS.

It's pretty simple: if the binary package is in Main or Restricted, it's officially supported.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mdeslaur — Sat, 08 Nov 2014 16:37:17 +0000

> But you know.. for the record.. can you point me to customer facing documentation that states that everything in main is supported by Canonical.. for future reference.

https://wiki.ubuntu.com/SecurityTeam/FAQ#Official%20Support

"Packages in main and restricted are supported by the Ubuntu Security team for the life of an Ubuntu release, while packages in universe and multiverse are supported by the Ubuntu community."

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mdeslaur — Sat, 08 Nov 2014 16:35:25 +0000

> There is software in universe that is supported by Canonical, and software in main that isn't really supported.

First I've heard of this, and I'm the one doing security updates.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

rahulsundaram — Sat, 08 Nov 2014 16:31:06 +0000

>And if you use third party repository's you break your support contract and remember there always is a reason for companies not include said software in their repositories.

Merely using a third party repository doesn't break any support contract. Red Hat merely won't commercially support packages from those repositories. Same goes for modified packages unless you can show that the problem occurs regardless of the modification.

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

mathstuf — Sat, 08 Nov 2014 15:13:10 +0000

> Should Canonical stop providing the unsupported-but-useful "universe" repository only because people

I don't see it in the discussion here, but isn't it *on* by default? Maybe if there were an explicit action users would need to take to enable it, it wouldn't be such an issue (there may be (I don't know for sure) but I'd like that detail in the discussion here)?

Ubuntu, ownCloud, and a hidden dark side of Linux software repositories (PC World)

johannbg — Sat, 08 Nov 2014 15:04:43 +0000

"RHEL does not include ownCloud in its repositories, so Red Hat will not support it. If you want ownCloud in your RHEL box you will have to use additional repositories."

And if you use third party repository's you break your support contract and remember there always is a reason for companies not include said software in their repositories.

"Should Canonical stop providing the unsupported-but-useful "universe" repository only because people, seeing the name "Canonical", may think that it is supported and maintained by Canonical?"

The answer to that is yes since Canonical is misleading it's "customers" by providing it in the first place.