OS-level package

[fishinthecalculator]

We only have a Guix package right now (and it hasn't been upstreamed yet). I might end up creating an AUR package since it should be quite low effort but it would be wonderful to have a package in Debian I believe. Right now I don't think we have the bandwidth to maintain an upstream Debian package so we welcome all effort in this direction.

[chobeat]

what would be the added value of such a package? we don't have any external dependency and pip gives us all the guarantees we need. Guix is already an overkill and adds a lot of maintenance complexity for little benefit. In what scenario would a user use a debian package instead of a simple "pip install"?

[fishinthecalculator]

We somewhat discussed this topic here, the idea of this issue is signal that there's interest and as a point of gathering for people interested in maintaining such a package.

what would be the added value of such a package?

Full integration with the system, things like:

• the ability to install and handle versioning of configuration files
• the ability to install shell completion scripts
• the ability to install and upgrade the package through the OS provided GUI "app store" (GNOME Software, the Ubuntu thing and the likes)
• zero hassle for using in a cron job. also i'm not sure but i believe a Debian package also has the ability to add and enable cron jobs through systemd
• transactional installation and upgrade (I'm not sure apt has those but guix and rpm do)

and so on and so forth.

we don't have any external dependency and pip gives us all the guarantees we need.

We most certainly depend on SQLite and Python, which depend on Bash and some other niceties. These kind of dependencies are provided by system package managers. Pip doesn't give us all the guarantees we need, it mostly guarantees to honor requirements.txt but it's not feasible to use for day-to-day package management, like we pointed out in #125.

Guix is already an overkill and adds a lot of maintenance complexity for little benefit.

Guix value is security and zero-trust deploys. We can collectively decide to ignore security problems, but it doesn't make them go away. Guix prevents things like 0, 1, 2, 3, 4 and trusting trust attacks by design, and in general it helps with supply chain attacks.

In what scenario would a user use a debian package instead of a simple "pip install"?

I'm not sure of the difference between apt install mobilizon-reshare and pip install mobilizon-reshare, but the scenario I'm describing is the one in which you are not supposed to break Debian, where you'd like to manage all software living on your PC with a single GUI and to apply security fixes once and for all without having to chase down libraries scattered all over your file system.

BTW it's also the same scenario in which a user installs docker-compose with apt and not with pip.