This feels like a good example of open source economics.A relatively small amount of money can create value for everyone who used Debian in the future.
$100 to a Debian Developer who can get Fresh Editor into Trixie
11–15 of 15 posts
Re: $100 to a Debian Developer who can get Fresh Editor into Trixie
#12Hello! I am a Debian Developer, though not likely to work on this as I haven't done a ton of rust binary packaging. I did want to clear up one misconception that you might be having, though. The .deb versions shipped by upstream are great, but they're not really ever going to be useful for Debian. One of the side-effects of Debian's requirements around software freedom is an important principle: you should be able to…
The problem that Debian has with rust packages is that they try to apply handling a C-style dependency chain (usually only a few C libraries with large scope) for the rust crate ecosystem (a lot of dependencies with small scope). Having to maintain 732 just for one release of a new package is not sustainable. I don't understand why the policy is not: pulling all crate sources and prepackaging into a tar with associat…
Security is part of it -- dpkg and apt were not built to deal with the problem of tracking each individual executables' complied library versions. When the next Heartbleed happens, how will you know which things need to be recompiled? (Some of this data exists in adjacent Debian systems for DD's internal use, but it's not integrated into dpkg in any way.)
https://wiki.debian.org/StaticLinking#downsides has some of the background there.
Re: $100 to a Debian Developer who can get Fresh Editor into Trixie
#13Out of the loop: Why not run this, from the top of the home page: curl https://raw.githubusercontent.com/sinelaw/fresh/refs/heads/m... | sh IMO this isn't part of your OS; it's cross-platform PC software. Install it using the bin its creators have provided. They have even built and are hosting a Deb for your linux distro (From inspection of the script)
I see in your posts that you do a lot with Rust and biology. Broadly, the same way you can use the tool "cargo install" to fetch a bunch of dependency crates from one source and be sure their versions can all run well together and update together, I can use the tool "apt install" to do the same for applications. The concept is called a "package manager" and it greatly helps me achieve a concept called "reproducible b…
That is some attention to detail in your research! I appreciate the explanation and examples. I think perhaps I am deliberately dodging the OP's question, treating it as an X/Y problem. He or she mentioned compliance as a valid reason, but it still feels like a smell: I think the original software could be installed using the provided deb, or building from source by cloning the repo and running `cargo run` on a Debian or Ubuntu system older than or the same version as the one he intends to use. (A Rule of Thumb I've found works well for Debian!)
I recognize that a lot of Linux users like the package system. I think it's a great tool for software that's intended to be integrated with the OS, but is a bit of a mismatch for third-party software. The creators here have even build a .deb, which is above and beyond. (Compared to, for exmple, compiling a +x linux executable that has been tested on Debian)
So, from a writer and user of software, I think I would rather publish the executables or a script to install them on my website (as they have done) for all the major OS branches, and as a user, I think c+ping and launching the CLI command they provided front and center is fantastic. It's an above-avg experience; a trivial install process, which isn't a given for OSS.
Re: $100 to a Debian Developer who can get Fresh Editor into Trixie
#14Earlier quoted context omitted.
The problem that Debian has with rust packages is that they try to apply handling a C-style dependency chain (usually only a few C libraries with large scope) for the rust crate ecosystem (a lot of dependencies with small scope). Having to maintain 732 just for one release of a new package is not sustainable. I don't understand why the policy is not: pulling all crate sources and prepackaging into a tar with associat…
Security is part of it -- dpkg and apt were not built to deal with the problem of tracking each individual executables' complied library versions. When the next Heartbleed happens, how will you know which things need to be recompiled? (Some of this data exists in adjacent Debian systems for DD's internal use, but it's not integrated into dpkg in any way.) https://wiki.debian.org/StaticLinking#downsides has some of th…
I think this is a fine description, and respect your reasoning! I think there is in this case, no conflict: Keep the OS-managed packages strict about dependency security, and let the user run the .deb or compiled program Fresh (or whatever software) has provided. So, I think your (Debian perspective), and Fresh (Providing binaries for download, including as a multi-linux script) is on the simpler/easier/just-works end of installing software. No conflicts. Single-CLI line install either way.
Re: $100 to a Debian Developer who can get Fresh Editor into Trixie
#15Hello! I am a Debian Developer, though not likely to work on this as I haven't done a ton of rust binary packaging. I did want to clear up one misconception that you might be having, though. The .deb versions shipped by upstream are great, but they're not really ever going to be useful for Debian. One of the side-effects of Debian's requirements around software freedom is an important principle: you should be able to…
(Fresh maintainer here)
Fresh itself has a few dozen direct dependencies. About 33 of those already exist on Debian. It boils down to these missing dependencies:
- The entire oxc toolchain — oxc_allocator, oxc_ast, oxc_codegen, oxc_diagnostics, oxc_isolated_declarations, oxc_parser, oxc_semantic, oxc_span, oxc_transformer
- rquickjs, rquickjs-serde (the QuickJS plugin engine)
- ts-rs
- jsonc-parser
- rust-i18n (this one has an open ITP)
If we build Fresh without plugins enabled, it's just the last three.