Why sysadmins almost never replace distribution packages

July 25, 2010

I mentioned this in passing recently; today I feel like elaborating on why replacing a distribution package with your own locally built version of something is a big pain in the rear and thus why sysadmins almost never do it.

(I'm going to assume here that you're familiar with building from source in general.)

First, you have two options for how to do this; you can build from source and just do a 'make install', or you can actually (re)build a new package and install it. Doing a raw build from source is horrible for all of the reasons that we have modern package management, plus you're going behind the back of your package management system and this generally doesn't end well.

Rebuilding a package is superficially more attractive, but it causes a number of issues. First, you need to know how to build and rebuild packages for the particular OS that you need the new version of the program on, and to have a build environment suitable for doing this. But let's assume that you can do all of this because you've already invested the time to become a competent package builder for this distribution.

Once you have a package, what you're doing is adding unofficial local packages to the distribution. When you do this, making everything work nicely together becomes your responsibility, and when you override a distribution package instead of adding a new one you also get the headaches of dealing with the distribution's own updates to the package. The distribution may update their version of the package in ways that clash with your version or simply cause your version to be removed, and they may change how the package works in ways that require you to immediately update your own version in order to keep working with the rest of the system.

(In short, you're essentially maintaining a fork of their package and you get to do all of the tracking and updating that that implies.)

In either case you now have to keep track of the upstream version yourself, in order to pick up security issues and (important) bugfixes. If you do not want to lock yourself to using the latest and greatest version, this may include backporting those changes to the older version that you're using. You will probably also want to keep track of the changes that your distribution thinks are important enough to include in their packaged version of the program.

All of this requires more than just work and time; it requires attention (to upstream changes, to distribution changes, to security alerts, etc). Attention is an especially scarce resource for sysadmins, much scarcer than time.

(The one time it starts being worth doing this is when a distribution has hit end of life. In that case, there will be no distribution package changes and the distribution has stopped tracking the upstream for security updates and so on anyways, so either you worry about it or no one will.)


Comments on this page:

From 71.116.163.154 at 2010-07-26 01:52:15:

All true, but sometimes it's worthwhile or necessary, especially for tools that you (or your users) use all the time and need to have up to date or to handle special circumstances (such as, say, nonstandard mail delivery locations you inherited).

I packaged or backported a lot of mathematical and scientific software, along with some TeX-related apps and newer versions of Emacs, for CentOS 3 and maintained them for several years. Having finally made the jump to CentOS 5, though, and having learned that no one actually uses most of the software I was asked to package, I've dropped support for most of my locally packaged software and rely instead on a couple of well-maintained third-party repos that do a good job of covering newer versions of key tools.

-- Claire

From 66.108.2.195 at 2010-12-11 07:53:17:

Without a third-party maintaining your important software to a sane level you will suffer. Using a linux distro that installs ~everything will further your pain as you will be stuck with old/buggy junk.

If your linux vendor is claiming to backport "the important stuff" then they're lying.

Written on 25 July 2010.
« iSCSI versus NFS
What I would now do differently in a file based blog engine »

Page tools: View Source, View Normal, Add Comment.
Search:
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Jul 25 23:52:43 2010
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.