News for hackers. Stuff that matters.
Re:DUR: The Debian User Repository by cookiengineer on Saturday June 26, 2021 @01:05AM (#27639271)
Disclaimer: Have been an apt shadow for a couple years and ran some PPAs on both launchpad and private servers.

Personally, I think the approach that upstream Debian uses in order to not include the headers of libraries with the binary builds is wrong.

Nobody has time to deal with over 30 GIGAbytes of hard drive memory that is just there because I wanted to rebuild a damn library of 20kB. That is a total fail, architecture- and build-system wise.

As long as Debian separates between distributed binaries, and -dev packages which include all source codes and headers - I would not recommend it for software development.

This is the exact reason of PPA fatigue, where end users have sometimes dozens of versions of the same library installed that is also an absolute security nightmare to begin with.

Reproducible builds are worth nothing if everybody has to use a PPA of some random untrusted blog post on the internet (omgubuntu anyone?) because Debian's packages are too outdated. Usually those PPAs are heavily outdated as they are built once and then abandoned for years.

Libraries are not upgradeable due to how other packages depend on them. They cannot be rebuilt without having to rebuild the whole operating system (have to rebuild X again? Well, gonna stop here then.)

Sorry for the rant, but I think in order for DUR to work in practice, these conceptual flaws have to be fixed upstream first.

Re:DUR: The Debian User Repository by viraptor on Saturday June 26, 2021 @02:51AM (#27639753)
> As long as Debian separates between distributed binaries, and -dev packages which include all source codes and headers - I would not recommend it for software development.

Is that the case for some specific languages? -dev packages for C and other compiled libraries do not include the full source code of the library. Normally they only include the headers, pkgconfig, and similar files.

> Libraries are not upgradeable due to how other packages depend on them.

Got some examples where it's a problem and not an actual dependency issue?

Re:DUR: The Debian User Repository by cookiengineer on Saturday June 26, 2021 @08:14AM (#27641209)
> Got some examples where it's a problem and not an actual dependency issue?

Try to recompile mesa or say, just the demos (aka glxgears) :) Worst case scenario for Debian dependencies.

Re:DUR: The Debian User Repository by viraptor on Saturday June 26, 2021 @08:45AM (#27641375)
I meant an example of what the issue is. Glxgears seems to have reasonable dependencies (https://packages.debian.org/buster/mesa-utils) gl1 and glu1 are not even restricted on versions.
Re:DUR: The Debian User Repository by seba_dos1 on Saturday June 26, 2021 @10:52AM (#27642367)
I regularly recompile mesa on my Debian-based phone and I'm not exactly sure what you mean. It goes painless.
Re:DUR: The Debian User Repository by tinus_hn on Saturday June 26, 2021 @03:37AM (#27639948)
So you would rather have them waste that exact same amount of space on every computer, just so you don’t have to download it when you want to build a package?
Re:DUR: The Debian User Repository by cookiengineer on Saturday June 26, 2021 @08:16AM (#27641220)
> So you would rather have them waste that exact same amount of space on every computer, just so you don’t have to download it when you want to build a package?

Header files are literally less than a couple kB per package, and Megabyte-sized headers are the exception for huge frameworks like QT or GACL. Arch packages don't ship the source codes, only the binaries (.so files) and headers (.h files).

Overall, the /usr/include folder on my system has less than 230MB, which is a damn lot because I have all kinds of compilers, programming languages and libraries installed. I even have 32Bit and atmel libraries installed because I do embedded reverse engineering and cross-compiling development on other architectures; so I also have gcc, LLVM, rust, go, C/C++ and other programming languages and their dependencies installed. So it's very likely much less than that for others.

If you cannot afford that, you should maybe choose another, smaller, distribution like "Damn Small Linux", Alpine or similar. Debian wouldn't be a good choice for that matter anyways.

Re:DUR: The Debian User Repository by tinus_hn on Saturday June 26, 2021 @01:15PM (#27643748)
I’m not sure what the argument is here. Either the header files you have to download are big so you shouldn’t have them on your system if you don’t need them, or they’re not big so it’s not a problem to just use the apt command to download all the header packages you need to build the package you want.
Re:DUR: The Debian User Repository by seba_dos1 on Saturday June 26, 2021 @10:55AM (#27642387)
> Arch packages don't ship the source codes

Neither do Debian's -dev packages.

Re:DUR: The Debian User Repository by creshal on Saturday June 26, 2021 @03:53AM (#27640016)
I don't have any Debian machine that doesn't end up with build-essential and dozens of header packages installed; it just comes up too often. Adding the header files directly to the packages saves time and frustration, and probably even saves space since a lot these packages are 50% overhead (dpkg meta files, db entries, etc.) by size.
Re:DUR: The Debian User Repository by _d7dt on Saturday June 26, 2021 @04:01AM (#27640046)
I don't install build-essential on a server, in a container, on a VM, etc. It really matters in those places. If you combine them then you lose the ability to deploy a small rootfs.
Re:DUR: The Debian User Repository by creshal on Sunday June 27, 2021 @02:28AM (#27649134)
Servers, VMs etc. always end up getting build-essential to handle random python/ruby/npm/... package installations, as the shipped versions are hopelessly outdated and creating your own debian packages for all of them is about as enjoyable as performing appendix surgery on yourself.

Multi-stage builds do make it a bit easier to get rid of them for containers, yes, but during the build stage it's still required.

Re:DUR: The Debian User Repository by tinus_hn on Saturday June 26, 2021 @04:22AM (#27640144)
I refuse to believe that these meta files and database entries are occupying anywhere near a relevant amount of space.
Re:DUR: The Debian User Repository by creshal on Sunday June 27, 2021 @02:24AM (#27649113)
Relatively.

Absolutely, it's negligible - because the space consumption of header files is also negligible. It's such a bizarre design choice to split out a single 30 line .h file into a separate package.

Re:DUR: The Debian User Repository by zxzax on Saturday June 26, 2021 @01:44AM (#27639434)
I'll try to respond to some of your comments, but I'll admit I'm always somewhat confused by rant posts. I never really understood PPAs, that seems like an Ubuntu thing that was not ever suggested to use in debian. If you want to stay on bleeding edge for packages, the suggestion would be to use debian sid.

I'm not sure what you mean 30 GB of memory. How is that related? And how would merging the -dev packages into the library packages solve it? IMO there are problems with the Debian approach but I wouldn't say that's one of them -- a worse problem to me is that things like cross-compiling/multi-arch mostly requires chrooting which is a lot less convenient than the approach used by something like Nix.

Re:DUR: The Debian User Repository by andrewshadura on Saturday June 26, 2021 @02:45AM (#27639716)
You don't need to chroot for cross-compiling, Debian supports multi-arch for most of the packages. You just install the cross-compiler, the cross-libc and all native development packages for the architecture you're building for.
Re:DUR: The Debian User Repository by zxzax on Saturday June 26, 2021 @03:13AM (#27639845)
Last time I tried that I had bad problems with package conflicts trying to overwrite files, but it was a while ago and maybe I was doing something wrong, I'll give it another shot.