All I wanted was, to make Fresh easy to install, for everybody, everywhere - really difficult tin it be?!
Windows and macOS aren't truthful bad, because they're comparatively uniform. For Windows, I usage winget - ugly, but useful (once I sewage past the first headache). For macOS, I'm utilizing homebrew for now, which isn't ideal, but it wasn't difficult to group up. I'll astir apt move to a much autochthonal signed mac app erstwhile I return the clip to package it correctly. Both solutions activity good for modern Windows and macOS users.
Linux is simply a different story. I started by releasing Fresh arsenic an npm package. This felt disfigured and annoyed immoderate group connected hn but besides has existent problems:
- Security - npmjs has had aggregate breaches and I want to slumber amended astatine night.
- Not universal - galore users don't person npm installed, why would they instal npm conscionable to instal Fresh?
- Weird installer - the npm instal flow, it's really a book that you get from npmjs which goes to github and downloads the correct binary artifact for your machine. You person to do this each clip you want to update.
So I listened to the irritated people's feedback, and (with the thief of respective gracious contributors) we went up and created packages for "EVERYTHING":
- rust's cargo connected crates.io (and besides cargo-binstall)
- un-distros for illustration AppImage and Flatpak
- deb
- rpm
- AUR (Arch Linux), 2 variants - root build and pre-built binary -bin package
- nix
- mise
- homebrew for linux (wtf?)
- npm / npx
- Terra
- Gentoo GURU
Plus I'm releasing pre-built binaries arsenic a tarball. You tin ideate really vulnerable each of this tin be. After each merchandise I wonderment if I'll deed immoderate problem aliases different pinch 1 of the galore channels.
Every 1 of those solutions works for some users but nary of them activity for all users. And they each person drawbacks.
"Why not usage nix?!"
Because galore group DON'T HAVE NIX installed and don't want to instal it conscionable to usage my app. I support nix arsenic a method but it doesn't activity for everybody.
"Just usage Flatpak!"
I do merchandise a Flatpak but I'm really moving against it. It's designed for self-contained sandboxed desktop GUI applications and I'm releasing a terminal-based TUI that allows you to rampage astir your instrumentality and network. I'm passing immoderate horrible "bad practice" flags to get it to work. Flatpak sandboxing is not a bully fit.
"Just usage AppImage!"
I do merchandise an AppImage, but it's highly slow to tally because of the squashfs FUSE-mount on-demand, which makes bringup clip unacceptably slow. I want my programme to commencement instantly, arsenic quickly arsenic technically possible. To make bringup times reasonable, my installer book bakes successful a horrible hack to extract the squashfs contents location and driblet the AppImage. You tin still conscionable tally the AppImage if you prefer, but it'll beryllium annoyingly slow to start. And successful some cases it requires FUSE to beryllium installed. Why does my app request FUSE?!
Also, since my binary requires immoderate minimal libc version, it isn't really universally portable (so for a 2-3 twelvemonth aged distro it mightiness not work), hence I mightiness arsenic good usage fixed linking and besides conscionable driblet AppImage. For immoderate logic I imagined that utilizing AppImage unsocial solves this portability problem.
Lastly, for various reasons, galore group person a bad position of AppImage and Flatpak (and Snap) and they would conscionable garbage to usage it. I lose.
Debian family symptom
As explained successful this different hn discussion I hadn't gotten astir to pushing my .deb arsenic a Debian (and Ubuntu) charismatic package, because it requires each the (many) rust limitations to besides beryllium Debian packages. There are galore bully reasons for this argumentation - afloat reproducible and self-contained builds for immoderate package, reduces proviso concatenation hell, etc. - but it's a batch of activity to do. And really will I ever support up - each 1 of my nonstop limitations will request to beryllium re-updated connected Debian connected each information rumor etc. I don't person clip for that. I can't conscionable vendor each my deps arsenic sources into my deb root package, that goes against the policy.
Another nosy anecdote is that I do want to support older machines moving e.g. older Ubuntu (and I conjecture immoderate older distro) - but these person older libc, meaning my build for newer ubuntu can't beryllium installed connected the older ones arsenic they neglect connected nexus correction astatine binary load time. So I'd person to build successful an aged Ubuntu instrumentality image and inherit its unpatched packages into my build - aliases driblet those users entirely. Neither action holds up.
No automatic updates for .deb / .rpm
Because it's specified a headache, I didn't get my package .deb (or .rpm) accepted into the charismatic sources. Therefore, group who instal these packages don't get automatic updates erstwhile they tally their system's autochthonal package update mechanism, apt-get upgrade aliases equivalent. It would've been bully if location was a speedy serverless solution wherever you could conscionable opportunity a URL to look for newer versions of a azygous package, and some apt and dnf would retrieve that and update a package.
I'm good alert that the "correct" point to do present is to get my package into the charismatic channels. I opened a bugzilla point for Fedora and personification started a immoderate point for Ubuntu and location are votes etc, but I conscionable don't person the clip and power to push these requests through. I conscionable want to GIVE AWAY MY SOFTWARE. I conjecture my constituent is: since group usage each kinds of distros, the compounded effort of doing this is very high.
Mise worked but past it didn't
Turns retired immoderate group usage mise arsenic their section (user-level) package manager. Someone sewage it to activity for Fresh, which is great! But 1 time it stopped moving pinch nary alteration connected my end. Turns retired GitHub rotated the certificate of its build attestation system, and mise had pinned an outdated spot guidelines alternatively of fetching the existent one. I didn't cognize thing was surgery until personification complained. I ended up fixing it myself but why americium I spending my clip connected that benignant of problem? Do I moreover cognize what I'm doing? I mean mise is cool and I besides usage it for immoderate projects but arsenic an writer of immoderate package instrumentality - location are conscionable excessively galore of these things to deliberation about.
Arch Linux AUR
I personally usage Arch AUR and besides supply Fresh done this transmission (both arsenic a root and pre-built -bin package), but lately it's been blocked for caller package releases. AUR is successful read-only mode because of immoderate information breaches, truthful I already missed a mates of type releases. So acold I person nary thought erstwhile AUR will beryllium back. As a mitigation I've reached retired to a maintainer to get Fresh into the Arch other repo alternatively of AUR, truthful possibly that will beryllium the solution.
The bottommost statement of each this ranting is that distro-specific channels are not a bully solution. As the number of distros and variants summation it's becoming adjacent intolerable to merchandise moreover a insignificant package.
Next steps: attraction connected the statically linked musl, self-updating binary
Do I moreover request a package manager?
I already build a musl binary arsenic portion of the release. The adjacent type will see a caller built-in self-updating system that users tin trigger connected demand. This will beryllium the main merchandise transmission for Linux and hopefully the only 1 I'll request to support going forward. All the existing packages will proceed to beryllium supported astatine slightest for the clip being. The extremity is to make the fixed binary the recommended default. By making it the default, I'm taking a consequence because who knows what different surprises it will bring - immoderate Linux portability rumor that will break my statically linked binary for immoderate people. They tin still build from root aliases usage 1 of the package files I'm still releasing, for now.
Basically I'm implementing my ain small package manager. Will it activity for everybody? Hopefully! Fresh is ~12MB to download and extracts to ~35MB truthful it should beryllium a reasonable acquisition overall. I'm perpetually moving connected reducing that last binary size too.
Is location thing other I tin do?
