Live data from Hacker News

RPM Packages Explained

fedoramagazine.org

51–57 of 57 posts

Re: RPM Packages Explained

#51
post #36

After spending years messing with RPM packages in the sysadmin world, I now breathe a sigh of relief with Arch/pacman. Building/maintaining/installing RPMs is painful compared to Arch or Debian's dpkg.

I thought dnf was the new hotness in the package management world. Is apt still superior?

apt was never superior. The biggest thing in dnf for me is transaction support. Basically, every time you do a package operation, dnf records the changes to its logs, and you can then revert it, downgrading the upgraded packages, installed the removed, and so on.

You can also revert multiple transactions at once, e.g. restore the package versions to what they were three months ago.

There's nothing remotely like this in apt -- if you install a lot of packages on your system, and then want to remove them, the common solution is something like "parse the (text) apt logs, learn manually what's changed, and revert it yourself".

Some other niceties:

* package groups: `dnf install @'c development'` instead of `apt install binutils gcc make bison yacc whatever-else`. Somewhat mitigated by metapackages, but they rarely cover the whole groups of functionality, i.e. they are often more low-level.

* package streams: `dnf install node-8`, or `node-9`, or one of the other supported versions;

* dnf downloads many packages in parallel, and the level of parallelism is configurable. This greatly helps with upgrades from slow mirrors. I believe it can also utilize multiple mirrors at once, though I haven't tried it.

* dnf supports plugins and you can install them with a simple command. For example, there's a plugin to automatically create btrfs snapshots on every package upgrade.

* COPR saved my skin a couple of times, though it's basically the same thing as Ubuntu's PPAs. This is more of a problem for Debian.

Re: RPM Packages Explained

#52
Sometime back a sys admin at my friend's work place asked them to package Java applications as RPM for deployment. I thought that was not a great idea and may be wrong tool for the job. But I will take this opportunity to ask people here if it was an OK suggestion?

Re: RPM Packages Explained

#53

This does not explain RPM packages, title is clickbait. But i'll try my hand at it... RPM files are a compressed CPIO archive with some magic flags and an embedded key-value store. When installed or uninstalled, rpms execute various arbitrary stages to manage changes to an operating system before, during, and after install or uninstall. So they introduce not only file changes (including changes to the system's RPM da…

Is it any better/different than deb packages ? (I'm NOT trying to start a flame war or Debian vs. Fedora troll, just asking out of pure curiousity).

Re: RPM Packages Explained

#54
post #53

This does not explain RPM packages, title is clickbait. But i'll try my hand at it... RPM files are a compressed CPIO archive with some magic flags and an embedded key-value store. When installed or uninstalled, rpms execute various arbitrary stages to manage changes to an operating system before, during, and after install or uninstall. So they introduce not only file changes (including changes to the system's RPM da…

Is it any better/different than deb packages ? (I'm NOT trying to start a flame war or Debian vs. Fedora troll, just asking out of pure curiousity).

It's definitely different, but both formats can do basically the same things. Personally I think a .spec and a .srpm are more succinct.

Where they really differ is the ecosystem. Debian has better tools for managing packages, and their community actually builds them better. But I've also been through dependency hell with both; if you want a bleeding edge release, it's way easier to skip packaging and manually build+install updated software to a unique directory.

Re: RPM Packages Explained

#55

Earlier quoted context omitted.

The sizes of all packages are a known information. So if someone is dedicated enough to track your downloaded packages, figuring out which ones were transferred with a single connection is relatively simple integer programming task. If you want to really hide what you are installing, make a local mirror of the entire repo and then pick and choose from that.

I thought _pmf_ was describing packages that he authored, and certainly if the contents of them are confidential, they would be in a private repository. I don't think that the RPMs that I have created in my internal repository and deploy to my field systems are a 'known information' to anyone outside of my organization. If they are, I'm in serious trouble. I think a more realistic use case for package-level encryptio…

[deleted]

Re: RPM Packages Explained

#56
post #36

Earlier quoted context omitted.

I thought dnf was the new hotness in the package management world. Is apt still superior?

apt was never superior. The biggest thing in dnf for me is transaction support. Basically, every time you do a package operation, dnf records the changes to its logs, and you can then revert it, downgrading the upgraded packages, installed the removed, and so on. You can also revert multiple transactions at once, e.g. restore the package versions to what they were three months ago. There's nothing remotely like this…

Interesting, thanks. How do you automatically revert a setup script though? Can you just not have setup scripts with dnf?

Re: RPM Packages Explained

#57
post #2

What's baffling to me is that there's support for signing,, but no support for an encryption layer. When delivering software updates for embedded devices, I need to do both, so I have to roll my own container format. This seems to also be the case with package formats like ipkg/opkg, which are targeted for the embedded use case.

Why not have a password-protected repository per client? If you need public dependencies, build them once and copy them to all repositories.

HTTP supports inline username and passwords, use HTTPS to keep the password encrypted on the wire: http://username:pass@server.tld/...

Post reply on HN