linux-kernel - Re: package managers [was: FatELF patches...]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 4 Nov 2009 22:11:47 +0100 (CET)
From:	Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>
To:	Valdis.Kletnieks@...edu
cc:	Martin Nybo Andersen <tweek@...ek.dk>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	"Ryan C. Gordon" <icculus@...ulus.org>,
	Måns Rullgård <mans@...sr.com>,
	linux-kernel@...r.kernel.org
Subject: Re: package managers [was: FatELF patches...]

> > > No, all they need to do is bump the .so version number.
> > 
> > That's what Debian did. Obviously, I can extract the old library from the 
> > old package. But non-technical desktop user can't.
> 
> But the non-technical user probably wouldn't have hand-compiled vim and links
> either, so how would they get into that situation?

Non-technical users won't hand-compile but they want third party software 
that doesn't come from the distribution. And package management system 
hates it. Truly. It is written with the assumption that everything 
installed is registered in the package database.

Another example: I needed new binutils because it had some bugs fixed over 
standard Debian binutils. So I downloaded .tar.gz from ftp.gnu.org, 
compiled it, then issued a command to remove the old package, passed it a 
flag to ignore broken dependencies and then typed make install to install 
new binaries. --- guess what --- on any further invocation of dselect it 
complained that there are broken dependencies (the compiler needs 
binutils) and tried to install the old binutils package!

Why is the package management so stupid? Why can't it check $PATH for "ld" 
and if there is one, don't try to install it again?

After few hours, I resolved the issue by creating an empty "binutils" 
package and stuffing it into the database.

Now, if I were not a programmer ... if I were an artist who needs the 
latest version of graphics software, if I were a musican who needs the 
latest version of audio software, if I were a gamer who needs the latest 
version of wine ... I'd be f'cked up. That's why I think that package 
management is an evil feature hurts desktop users. As a technical user, I 
somehow solve these quirks and install what I want, as a non-technical 
user, I wouldn't have a chance.

Mikulas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/