Developers: Let distros do their job September 27, 2021 on Drew DeVault's blog

I wrote a post some time ago titled Developers shouldn’t distribute their own software, and after a discussion on the sr.ht IRC channel today, the topic seems worthy of renewed mention. Let’s start with this: what exactly is a software distribution, anyway?

I use “software distribution” here, rather than “Linux distribution”, because it generalizes better. For example, all of the major BSD systems, plus Illumos and others besides, are software distributions, but don’t involve Linux. Some differ further still, sitting on top of another operating system, such as Nix or pkgsrc. What these systems all have in common is that they concern themselves with the distribution of software, and thus are a software distribution.

An important trait of these systems is that they function independently of the development of the software they distribute, and are overseen by a third party. For the purpose of this discussion, I will rule out package repositories which are not curated by the third-party in question, such as npm or PyPI. It is no coincidence that such repositories often end up distributing malware.

Software distributions are often volunteer-run and represent the interests of the users; in a sense they are a kind of union of users. They handle building your software for their system, and come to the table with domain-specific knowledge about the concerns of the platform that they’re working with. There are hundreds of Linux distros and each does things differently — the package maintainers are the experts who save you the burden of learning how all of them work. Instead of cramming all of your files into /opt, they will carefully sort it into the right place, make sure all of your dependencies are sorted upon installation, and make the installation of your software a single command (or click) away.

They also serve an important role as the user’s advocate. If an update ships which breaks a bunch of other packages, they’ll be in the trenches dealing with it so that the users don’t face the breakage themselves. They are also the first line of defense preventing the installation of malware on the user’s system. Many sideloaded packages for Linux include telemetry spyware or adware from the upstream distributor, which is usually patched out by the distribution.

Distributions are also working on innovative projects at the scale of the entire software ecosystem, and are dealing with bigger picture things than you need to concern yourself with. Here are some things which they have already solved:

There are several areas of open research, too, such as reproducible builds or deterministic whole-system configuration like Nix and Guix are working on. You can take advantage of all of this innovation and research for the low price of zero dollars by standing back and letting distros handle the distribution of your software. It’s what they’re good at.

There are a few things you can do to make this work better.

See also: FOSDEM 2018 - How To Make Package Managers Cry

One thing you shouldn’t do is go around asking distros to add your program to their repos. Once you ship your tarballs, your job is done. It’s the users who will go to their distro and ask for a new package. And users — do this! If you find yourself wanting to use some cool software which isn’t in your distro, go ask for it, or better yet, package it up yourself. For many packages, this is as simple as copying and pasting a similar package (let’s hope they followed my advice about using an industry-standard build system), making some tweaks, and building it.

Distros are quite accessible projects, packaging is usually not that difficult. Distributions always need more volunteers, and there are plenty of friendly experts at your local distro who would be pleased to help you figure out the finer details, assuming you’re prepared to stand up and do the work yourself. Once you get used to it, making and submitting a new package can take as little as 10 or 15 minutes for a simple one.

Oh, and if you are in the developer role — you are presumably also a user of both your own software and some kind of software distribution. This puts you in a really good position to champion it for inclusion in your own distro :)


P.S. Systems which invert this model, e.g. Flatpak, are completely missing the point.

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Willingness to look stupid

People frequently1 think that I'm very stupid. I don't find this surprising, since I don't mind if other people think I'm stupid, which means that I don't adjust my behavior to avoid seeming stupid, which results in people thinking tha…

via Dan Luu October 21, 2021

Status update, October 2021

Hi! Another month, another status update. Let’s dig in! The highlight of this month is the launch of chat.sr.ht, a hosted IRC bouncer service based on soju and gamja. The service is in closed beta for now, feel free to ping me if you want to try it out! It to…

via emersion October 18, 2021

What's cooking on SourceHut? October 2021

Welcome back for another month’s status update! As of today, our community numbers at 25,074 — the first time we’ve had over 25,000 users — after another 522 users joined our ranks. Please show them the courtesey and patience you’ve always done as they learn…

via Blogs on Sourcehut October 15, 2021