• mlg@lemmy.worldEnglish
    72·
    13 days ago

    Dependencies:

    Old ass library version from 2004

    apt/dnf/pacman: package not found

    library package was last available 15 years ago before it was dropped to move to the next legacy version

    App package was available right up until last year until it was dropped for development inactivity

    Absolutely no one has a compiled version of old ass library

    Attempting to compile old ass library results in 30 other old ass package dependencies

    How in the actual world was the maintainer compiling this up to last year

  • Chee_Koala@lemmy.world
    522·
    13 days ago

    Why even use releases? Everyone can build everything for themselves. ‘Normal Users’ are just lazy, everyone wants to know how every piece of software is built for their system, it’s not like they have other stuff to do.

    • Maki@lemmy.blahaj.zone
      14·
      13 days ago

      I thought that was what Gentoo was doing, but they have far more binary packages nowadays than I thought they’d ever get.

      • msage@programming.dev
        4·
        12 days ago

        llvm, clang are packages I give 0 fucks about, but take a significant part of my updates. I never really got around to it, but I will try to make them binary downloads instead of building that shit. Like I understand gcc, but have 0 interest in llvm, and can’t have firefox without it… smh

  • Lucy :3@feddit.org
    29·
    13 days ago

    yay <package name>

    There is a 99% chance it’s in there, and there is an 80% chance it uses the latest version/git HEAD

      • rtxn@lemmy.worldM
        25·
        13 days ago

        yay, a utility to access the AUR, where users share build scripts instead of binaries. It’s just one step above curl | sudo sh in terms of security.

        • Lucy :3@feddit.org
          8·
          13 days ago

          Except it automates the steps you’d have to take to inspect and edit the script, if needed. Also, PKGBUILDs are much nicer to read than just plain install scripts. And, of course, it actually builds a package, which is then installed, so it’s not only tracked but can be updated like the rest of the system.

            • Lucy :3@feddit.org
              3·
              13 days ago

              I’d say that yay encourages checking the PKGBUILD or its diff more than the average “curl xy | sudo sh” instruction, but considering most people see yay just as yet another package manager, instead of an AUR helper, that’s probably true for most people

              • rtxn@lemmy.worldM
                2·
                12 days ago

                That’s why it’s one step above. The user is given an option to read the PKGBUILD (or a diff with the cached copy if it exists), but beyond that, it’s still unverified arbitrary code from an external source (the project’s actual source, binaries, or packages from another repository). Packages in the official Arch repos are verified by the downstream packagers. For AUR packages, it’s up to the community to moderate itself, and the user to determine whether the package is trustworthy, and I’m willing to bet that not many people do it. I certainly don’t vet everything I install.

              • copygirl@lemmy.blahaj.zoneEnglish
                2·
                13 days ago

                That’s probably the “just one step above” part. You do have the option to inspect the script you’re executing before you do so with curl | sh too, if you know what you’re doing. If you don’t, then you’d be pretty likely to just skip the prompt from yay as well. (Automatic diffs are nice tho.) Note: I use paru instead so I don’t know what yay does.

        • Flipper@feddit.org
          3·
          13 days ago

          I don’t think the aur can switch the delivered script whether you are piping it into sh or not.

  • Lembot_0001@lemm.ee
    193·
    13 days ago

    Nobody likes to figure out dependencies. And C++ template errors are sometimes completely crazy.