this post was submitted on 24 Nov 2023
1207 points (95.0% liked)

linuxmemes

21222 readers
78 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.

    • Please report posts and comments that break these rules!

    founded 1 year ago
    MODERATORS
    [email protected]
    [email protected]
    [email protected]
    1207
    It's (usually) already installed (lemmy.ml)
    submitted 11 months ago by [email protected] to c/[email protected]
    148 comments fedilink hide all child comments
     
    you are viewing a single comment's thread
    view the rest of the comments
    [โ€“] [email protected] 7 points 11 months ago (1 children)

    It downloads a package, it installs a package and then offers to remove that package. How is it not a package manager?

    [โ€“] [email protected] 1 points 11 months ago* (last edited 11 months ago)

    A package typically includes the program and its data inside the package. It's not just an install script. Imagine if Chrome's MSI installer was simply a wrapper that also downloaded the browser. Imagine if there was a vulnerability with this, and it downloaded and installed something else. Since the package didn't include the program files, it wouldn't be able to tell if they were genuine. It only fetched the MSI, which was a download that initially passed the expected checksum (if it even does that).

    Additionally, file lists help ensure that programs and packages don't conflict with one another. What if you wanted Chromium and Chrome at the same time. Can you do that? Simply wrapping an MSI doesn't guarantee that. Perhaps there are conditionals in an installer that includes a vendored library under some circumstances, which would make them conflict.

    What about package removals? Some programs leave a bunch of junk behind in their uninstaller. Typically, since packages very often contain their own files, they simply delete their files when they're being upgraded or removed. If a package manager puts full trust in an MSI to always be exactly correct, then it loses complete control over correctly managing file removals.

    I could go on and on, with more examples, but "run this binary installer" is the Wild West of putting software on your system. This is mostly the status quo on Windows, but this is a very poor standard. Other operating systems have solved this problem with proper packaging for decades.

    When building a package from sources, it makes sense to wrap installers, but then you produce a package that is typically distributed by a mirror. These packages would then by downloaded by you, and contain the source of truth that is trusted to be what it is and that it'll do what it's supposed to do without any doubts to consistency and security.