[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: third-party packages adding apt sources



On 05/20/2016 10:35 PM, Vincent Danjean wrote:
Le 19/05/2016 19:20, Hakan Peker a écrit :
On 05/19/2016 06:18 PM, Daniel Pocock wrote:
  From a technical perspective, can we do more to prevent users being
surprised by packages putting new entries in /etc/apt/sources.list.d?

Please no. The system is working as intended. I don't think anybody is surprised after installing a 3rd party deb package and seeing it adds its apt repository to the system, actually they would be pleased to know that they won't have to manually update it later. And anybody who is uncomfortable with it would either disable it or not install the deb in the first place.

   Please yes.

   I built some (local) packages to easily install the same sources.list
on several machines, so I agree the feature in useful and interesting.
I named my packages like *-sources and the description is explicit.

   But I've been very suprised when I discovered that the google-earth
package installed a sources.list on my parents' computer after I
downloaded and install an application deb with dpkg.
   And even more when I see that the source is silently reinstalled when
you remove it (no respect of admin modification)

   Would it be possible to have a package that install a trigger and
advertise (debconf/mail/...) when such a change occurs? I would install
it anywhere personally.


You looking for a technical solution to a social problem. sources.list exist for the very purpose that repositories can be added to the system. A system where this facility don't exist or restricted is a form of walled garden.

Adding an update repository for the very same package the user has deliberately installed is a *convenience*. It is disrespectful of admin modification only if the program keeps reverting the admin modification and doesn't provide an option to disable this behavior. At that point you would be better contacting upstream that you are not comfortable with the behavior and you want such an option to disable the repository.

-------------------------------------------------

ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands!
$24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!
Reply to: