== The Ubuntu package roulette Today I got to re-learn a valuable lesson, which is that ~~just because something is packaged in Ubuntu doesn't mean that it actually works~~. Oh, it's probably not totally broken, but there's absolutely no guarantee that the package will be fully functional or won't contain problems that cause cron to email you errors at least once a day because of [[an issue that's been known since 2015 https://bugs.launchpad.net/ubuntu/+source/clamav-unofficial-sigs/+bug/1469915]]. I know the technical reasons for this, which is that Ubuntu pretty much blindly imports packages from Debian and Debian is an anarchy where partially broken packages can [[rot quietly https://bugs.debian.org/cgi-bin/pkgreport.cgi?package=clamav-unofficial-sigs]]. Possibly completely non-functional packages can rot too, I don't actually know how Debian handles that sort of situation. Ubuntu's import is mostly blind because Ubuntu doesn't have the people to do any better. This is also where people point out that [[the package in question https://packages.ubuntu.com/search?keywords=clamav-unofficial-sigs&searchon=names&suite=all§ion=all]] is clearly in Ubuntu's *universe* repository, which [[the fine documentation https://help.ubuntu.com/community/Repositories/Ubuntu]] euphemistically describes as 'community maintained'. (I have my opinions on Ubuntu's community nature or lack thereof, but this is not the right entry for that.) All of this doesn't matter; it is robot logic. What matters is the experience for people who attempt to use Ubuntu packages. Once you enable *universe* ([[and you probably will UbuntuUniverseImportance]]), Ubuntu's command line package management tools don't particularly make it clear where your packages live (not in the way that Fedora's _dnf_ clearly names the repository that every package you install will come from, for example). It's relatively difficult to even see this after the fact for installed packages. The practical result is that an Ubuntu package is an Ubuntu package, and so most random packages are a spin on the roulette wheel with an uncertain bet. Probably it will pay off, but sometimes you lose. (And then if you gripe about it, some people may show up to tell you that it's your fault for using something from *universe*. This is not a great experience for people using Ubuntu, either.) I'm not particularly angry about this particular case; this is why I set up test machines. [[I'm used to this sort of thing from Ubuntu UbuntuBugReportsUseless]]. I'm just disappointed, and I'm sad that Ubuntu has created a structure that gives people bad experiences every so often. (And yes, I blame Ubuntu here, not Debian, for reasons beyond the scope of this entry.)