Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certbot deprecates operating system packages, “standardizes” on snaps

certbot.eff.org

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#31

Post by hlieberman »

Havoc wrote: post #9

Literally just switched from Ubuntu to Debian to get away from snaps

Hello there! As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. We will still maintain them going forward in line with standard Debian practices, including security backports to stable as necessary.

Upstream fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target new and inexperienced users who may not understand why they are not getting the latest software when they see it was updated "on the website".

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#32

Post by hlieberman »

As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. The EFF fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target new and inexperienced users who may not understand why they are not getting the latest software when they see it was updated "on the website".

If any of you have concerns specifically about certbot on Debian, please feel free to contact me directly at my username @debian.org.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#33

Post by hlieberman »

lstamour wrote: post #29
ryebit wrote: post #23

Earlier quoted context omitted.

Linux Mint has even removed snap, which is impressive since they're downstream from Ubuntu. After hearing some of the issues with it (here and elsewhere), I'm kinda grateful to them for making the effort. Though this concerns me -- I use certbot on some debian servers, I hope that at least stays up to date.

Debian is still on version 0.x when the snap is at 1.1 ... this is one of those cases where the Debian stable branch is too stable when you need to ship software that interacts with a lot of remote APIs the way the certbot-dns packages do. It’s impossible to use the old Debian versions with the more secure API tokens from CloudFlare, for example.

The certbot-dns packages are certainly the most fragile part of the process -- however, I don't have any bug reports showing that the version in stable is currently broken for any of the dns plugins.

If you're experiencing that, please file a bug against them and I can look into having a stable backport done for them.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#34

Post by hlieberman »

linsomniac wrote: post #17

Just to clarify something I think a lot of replies don't understand: The Ubuntu Certbot packages have been horribly broken for well over a year, probably at least two. The PPA for Certbot includes updates of a lot of OS packages, with with incompatibilities with other Ubuntu provided packages. I've spent hours tracking down and fixing the problems that have come from installing certbot via apt. Usually, I'm much more…

Hello!

I formerly maintained this PPA before turning it over to some of the Ubuntu people. It's my understanding that certbot is going to be migrated out of universe soon and into the main Ubuntu archive. That will cause it to gain full support from Canonical. Either way, we will continue to support certbot in Debian (upstream of Ubuntu, if downstream from /actual/ upstream) indefinitely. The Ubuntu maintainers and I work closely on packaging.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#35

Post by lokedhs »

floatingatoll wrote: post #8
bccdee wrote: post #5

Earlier quoted context omitted.

A distro-independent avenue for distribution could be important, but surely we can do better than snapd.

Have we done better, or is snapd the best option for their needs as of today?

Flatpak, probably.

I'm not saying Flatpak is great, but it's the best we have, in my opinion.

That said, having published one application on Flathub, packaging Flatpak is not a great experience, especially when the two major repositories: Flathub and Fedora both use two completely different build processes.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#36

Post by erik_seaberg »

lstamour wrote: post #24
ohazi wrote: post #15

Snaps require you to allow each publisher to automatically push arbitrary software updates to your machine, and snap deliberately does not allow you to disable this misfeature. It's not a bug or an oversight -- it's part of the design of snap, and it's not going to change. Handing out the keys to the kingdom like this is supremely annoying on a desktop (e.g. Windows 10), but it's completely unacceptable on a server.…

I agree — the auto-updating nature of Snaps are a problem without an easy solution: https://askubuntu.com/questions/930593/how-to-disable-autore... But I would also point out that on stable Debian it’s near impossible to deploy Certbot because the versions available are too old, especially the plugins. I’ve been routinely installing the snap instead because it’s a quick and easy way to deploy the service at the lates…

Too old in what way? Is the Debian stable version relying on something that Let’s Encrypt is deprecating?

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#37

Post by ohazi »

hlieberman wrote: post #32

As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. The EFF fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target new and inexperienced users who may not understand why they are not getting the latest software when they see it was updated "on the website". If any…

Good to hear, and thanks for your work on this!

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#38

Post by mariopal »

hlieberman wrote: post #32

As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. The EFF fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target new and inexperienced users who may not understand why they are not getting the latest software when they see it was updated "on the website". If any…

Thanks for your work!

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#40

Post by Havoc »

hlieberman wrote: post #31
Havoc wrote: post #9

Literally just switched from Ubuntu to Debian to get away from snaps

Hello there! As the maintainer of certbot for Debian, I promise you that there's no intention of deprecating the certbot packages that exist in the archive. We will still maintain them going forward in line with standard Debian practices, including security backports to stable as necessary. Upstream fully supports this decision and has promised to continue to assist. Their recommendation for snaps is meant to target…

>Hello there! As the maintainer of certbot for Debian

Thank you for the good work!

That's good news & will have a go at the apt version then.

Post reply on HN