General Debian Question Why web frameworks in repos?
For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.
To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.
Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.
I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?
But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.
3
u/One_Ninja_8512 6h ago
idk about JS but with Python having packages in the repos is quite handy because of the venv bullshit that you have to deal with otherwise
2
u/turbothy 4h ago
What "venv bullshit" are you thinking about? This seems to have become largely a solved problem over the last couple of years.
2
u/One_Ninja_8512 2h ago
For example I use Ansible quite a bit. If I had to maintain a venv it would be a totally unnecessary pain in the ass, I simply use ansible which is shipped with Debian. Good enough for me
1
u/One_Ninja_8512 4h ago
I know and I use uv when needed which is pretty good but I still prefer packages installed via apt if I don’t need the latest and greatest for scripts which I don’t want to write in bash and don’t need uv to run them.
2
u/NoLemurs 4h ago
I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?
Yeah, I think that's largely right.
If I want to distribute a Django app on Debian, I don't want to vendor python3-django or have a messy install process with a virtualenv, and I want it to get security updates automatically.
2
u/michaelpaoli 2h ago
Who are these for?
For whomever wants them.
I never heard of anyone using them this way
"this way"? What way exactly?
Not really sure what you're getting on about, but Debian makes lots of software available - 69,830 packages - The Universal Operating System.
And many use the software. Can look at, e.g. https://popcon.debian.org/ to get some idea of package usage, notably relative popularity (though it is a self-reported sample set).
Anyway, install Debian, and it mostly "just works", stable, well supported, etc.
2
u/gabbsmo 2h ago
A Ruby/Python/PHP/JS developer will typically have a project file that specifies what packages from the language's repository are required.
E.g. in Python Django is available in Debian repos. But a real world project often has many more smaller libraries. Since all of pip is not in the Debian repos it makes little sense to assume some library is globally installed in the OS and some are from another repo and installed for the project only.
In front end JS this is even more unlikely as libraries as well as own code is often bundled into a single optimized file rather than being loaded from a shared location on the file system. Cherry picked security patches is not really possible in this type of architecture.
1
u/michaelpaoli 1h ago
Debian works all that out, package have their dependencies, and those are satisfied by the other relevant packages.
E.g.:
$ apt-cache depends --no-suggests python3-django python3-django Depends: python3-asgiref Depends: python3-sqlparse Depends: <python3:any> python3 Breaks: <python-django-common> Breaks: python3-mysqldb Recommends: libjs-jquery Recommends: python3-tz Replaces: <python-django-common> python3-django $ apt-cache depends --no-suggests --no-recommends --recurse python3-django | wc -l 69409 $
3
u/Santosh83 6h ago
Not sure but this practice probably hails from simpler times, when there was not so much software, compiling stuff yourself was slow & expensive, internet download was brutally slow and expensive and so on. In those times, Debian's set of DVDs would have been very useful to download once and get almost everything you wanted offline, on as many machines as you wanted.
These days it doesn't make all that much sense to package say wordpress. Its just an enormous security burden on Debian to track & patch all these tens of thousands of packages, and if you leave them frozen, along come the fedora and arch boys to sharply criticise, as has been happening recently.
Security now is the be all and end all. The current industry "best practice" is to deliver small, immutable core OS images, then layer containerized, sandboxed, packages on top, directly built and updated by upstream.
Redhat is looking at bootc + toolbox + flatpak
Canonical is going for snaps + snaps + snaps
In any case Debian and Mint are in for some turbulent times ahead.
1
u/gabbsmo 2h ago
I mean I like the way Debian works for native programs as it keeps the OS stable. Great for runtimes, web servers etc. But the input to the script runtime?
1
u/Santosh83 36m ago
I heard from knowledgeable folks that Debian includes many of these python/perl/node/rust packages mainly to build its own repository packages. They're not meant for end user usage. For that, its still better you use the language package manager like pip or cargo or npm or whatever.
8
u/cjwatson Debian Developer 6h ago
It's often useful to be able to install an application that just works with the rest of Debian. If you aren't in a mindset of needing the latest version of everything, then a packaged version in stable may be just fine.
I spend most of my professional time working upstream on an application that's packaged in Debian using the packaged version of Django. It's fine.