0

Looking for software, including less free, proprietary style e.g. visual studio code, github-cli, spotify:

What are the downsides and upsides of adding or configuring a Debian repository?

Debian wiki states reasons for the existence of unofficial Debian repositories. I ask why to use or not use such unofficial repositories compared to installing from source (download a file and carry out commands from terminal) or even changing distribution 5. Or at least, what is reasonable to consider in judging whether to add or configure a repository in order to install new software on one's Debian?

  • is the repository secure, and how do you know?
  • how do you guess whether it is much easier to install/update the software using the unofficial repository?
  • and so on

1 Answer 1

1

The security can be a reason to avoid adding third party repositories. Then with Debian 11, I know there is a security team which pushes patchs for its packages, and even obsolete packages like php7.4 are updated. I could add deb.sury.org, but I don't know if it will makes things better (with php8) or worse. Only the history of the repositories can tell.

Note that some software (grype) can perform a comparison between what is installed and a CVE base. Then you have some ways to manage your security.

Note that the security depends of the nature of the software. Software which are executed from your desktop or shell will most likely be safer than a software exposed to the Internet (Apache or CGI modules).

About compatibility, there is no definitive answer too. A page like https://deb.sury.org/ clearly indicates which distributions are the target. Most alternative repositories should have a documentation about the target distribution. With this example, if you have yet another Debian derived distribution, the compatibility is not tested, then not garanteed.

manageability. You can have softwares which have no configuration or whose the default configuration fits most cases. Then the impact is null. Some others needs configuration. Then when first installing postfix (which is part of most distribution), some questions are asked to adapt its behaviour to your needs (the right domain, etc), and you may also need to configure it further depending of your needs (SMTP authentication...). Then, there are no absolute rules, and an upgrade of system (even with only the distribution repositories) can ask many questions (use the new configuration file vs. keep the previous, ...). And you may need to manually merge 2 configuration files (the old adapted to your need and the new version which provides more options).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .