== My view of Debian's behavior on package upgrades with new dependencies

In
[[the primary Reddit discussion
https://www.reddit.com/r/linux/comments/4cfdcy/an_awkward_confession_and_what_we_should_do_about/]]
of [[my entry about actually learning apt and dpkg ShouldStudyDpkgAndApt]],
[[yentity asked an entirely sensible question
https://www.reddit.com/r/linux/comments/4cfdcy/an_awkward_confession_and_what_we_should_do_about/d1hsnx5]]:

> Why is this [apt-get's _--with-new-pkgs_] not enabled by default in
> debian / ubuntu ?

The ultimate answer here is 'because Debian has made a philosophical
choice'. Specifically, Debian has decided that no matter what the
person building the new version of a Debian package wants or feels
is necessary, an '_apt-get upgrade_' will never add additional
packages to your system. If the builder of the package insists that
a new version requires an additional package to be installed, it is
better for the upgrade to not happen. Only '_apt-get install <pkg>_'
(or '_apt-get dist-upgrade_') will ever add new packages to your
system.

Regardless of what you think about its merits, this is a coherent
position for Debian to take. In an anarchic packaging environment
with individual Debian developers going their own way, it even has
a fair amount of appeal. It certainly means that package maintainers
have a strong pragmatic incentive not to add new dependencies, which
probably serves to minimize it (which is one reason Debian has
apt-get behave this way).

My personal view is that I prefer an environment where package
builders are trusted to do the right thing with package dependencies
in new versions of their packages, whatever that is. Packages can
get new dependencies for all sorts of good reasons, including that
what used to be a single package is being split up into several
ones. As a sysadmin outsider, I'm not in a good position to second
guess the package maintainer on what dependencies are right and
whether or not a new one is harmful to my system, so in a trustworthy
environment I'll just auto-install new dependencies (as we now do
on Ubuntu where it's possible).

(The Debian package format has also made [[some structural decisions
WhyAptIsFaster]] that make things like splitting packages more of
a pain. In an RPM-based system, other packages often don't notice
or care if you split yours up; in a Debian one, they're more likely
to notice.)

It's worth pointing out that this trust fundamentally requires work
and politics, in that it requires a policy on 'no unneeded dependencies'
(and 'no surprises in package upgrades') and then [[a group of
people https://fedoraproject.org/wiki/Packaging_Committee]] who are
empowered to judge and enforce the policy (overriding package
maintainers when necessary). This sort of control probably does not
go well with a relatively anarchic project and it's certainly a
point of argument (and one could say that Debian already has enough
of those).