1

I recently learned that Debian based distros essentially have a fixed collection of communal dependencies and libraries which any application installed through a package manager is required to use.

Contrast this against say, Windows, where I believe each application typically provides its own dependencies - and therefore a Windows OS installation will have instances of the same dependencies/libraries installed many times and each application will need to manage the updating of these dependencies on its own.

I know some developers develop their software to be compatible with the APT package manager, but I imagine there must be many applications where the developers have created the software in the "Windows" way.

So my question is, if the upstream developers created their software with the intention to distribute a large monolithic install complete with bundled dependencies, do the APT package maintainers need to rewrite the source so that the software uses the communal collection of dependencies rather than the local dependencies?

If so, does this occur often and is this a major task for package maintainers?

Improve this question

2 Answers 2

Reset to default
2

So my question is, if the upstream developers created their software with the intention to distribute a large monolithic install complete with bundled dependencies, do the APT package maintainers need to rewrite the source so that the software uses the communal collection of dependencies rather than the local dependencies?

Not necessarily, as long as the monolithic install doesn't conflict with an existing library or filename. That is, if the system already has a /lib/foobar (version 12), and the monolithic package requires and bundles foobar v. 9, that monolithic package can't store its foobar v. 9 using the filename /lib/foobar, because that pathname is taken -- but it could use /lib/foobar_v9, or perhaps .../monolithic_app_dir/lib/foobar.

If so, does this occur often and is this a major task for package maintainers?

Yes, preventing and if need be sorting out various levels of dependency hell is much of what package maintainers do.

Improve this answer
3
  • thanks. so if a monolithic style application bundled and referenced its own dependencies in a namespaced way so it didn't collide with the system version, would the package maintainers typically say ok it works, I won't touch it? which in that case, it would mean that packages in the debian repos would sometimes use their own bundled dependencies and sometimes use the communal system dependencies?
    – the_velour_fog
    Jun 26, 2016 at 3:07
  • It's up to the packager, but for a 100% bundled package full of thorny rabbit holes, there's no reason to fix what ain't broke. But yes, Debian repos have included packages that use all sorts of dependencies -- bundled libraries, forked libraries, libraries that conflict with competing packages, and who knows what else... (For a more radical experiment in packaging, there's stuff like the NIX package manager, which bundles virtually everything.)
    – agc
    Jun 26, 2016 at 3:53
  • I think the new Ubuntu snaps are all about too...
    – the_velour_fog
    Jun 26, 2016 at 4:27
2

Debian policy is that libraries, tools, etc bundled with a program should be unbundled from it when creating a debian package. Debian policy also requires that libs be split into at least a runtime package (e.g. libfoo-version) and a development version with the static library and headers (e.g. libfoo-version-dev).

What you do on your own system is your own business, but any Debian developer (DD) packaging a monolithic application is expected to unbundle - which means either depending on the existing libraries in Debian or creating packages for them if they don't already exist.

Other distros may have different policies, but most will require packages in the official repos to be unbundled - because bundling subverts the point of packaging, and makes it harder to, e.g., apply library security updates to all programs that use a particular library.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.