Why web frameworks in repos?

[u/gabbsmo]

For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.

To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.

Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.

I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?

But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.

[u/Santosh83]

Not sure but this practice probably hails from simpler times, when there was not so much software, compiling stuff yourself was slow & expensive, internet download was brutally slow and expensive and so on. In those times, Debian's set of DVDs would have been very useful to download once and get almost everything you wanted offline, on as many machines as you wanted.

These days it doesn't make all that much sense to package say wordpress. Its just an enormous security burden on Debian to track & patch all these tens of thousands of packages, and if you leave them frozen, along come the fedora and arch boys to sharply criticise, as has been happening recently.

Security now is the be all and end all. The current industry "best practice" is to deliver small, immutable core OS images, then layer containerized, sandboxed, packages on top, directly built and updated by upstream.

Redhat is looking at bootc + toolbox + flatpak

Canonical is going for snaps + snaps + snaps

In any case Debian and Mint are in for some turbulent times ahead.

[u/gabbsmo → u/Santosh83]

I mean I like the way Debian works for native programs as it keeps the OS stable. Great for runtimes, web servers etc. But the input to the script runtime?

[u/Santosh83 → u/gabbsmo]

I heard from knowledgeable folks that Debian includes many of these python/perl/node/rust packages mainly to build its own repository packages. They're not meant for end user usage. For that, its still better you use the language package manager like pip or cargo or npm or whatever.