Hacker News Reader

Comment by ColinDabritz | Hacker News Reader

PPA = Personal Package Archive

As someone who is unfamiliar with this term, can someone please summarize what it means? What makes it appealing?

Thank you in advance.

PPAs are how people build custom packages for Ubuntu, most often to support newer versions of software over what's available in the official package list.

This is particularly helpful when working with LTS (Long Term Support) versions. I have many servers who are still 12.04. I need to install Node 0.12, but the official packages are stuck in 0.6. PPAs make this possible without having to build from source or otherwise hack your way around the system.

Typical use cases for me our to get the latest stable Nginx, PHP, HAProxy and similar popular packages without having to upgrade to a non-LTS release of Ubuntu.

This would be really interesting to see on Debian!

These types of things are already available (and I would wager much more stable than the type of thing found in PPA's) through third-party repositories like http://Dotdeb.org

Honestly I think PPA's only real-world appeal will be for desktop Debian users.

No one with any rational thought process is going to use a PPA sourced package on a server environment.

edit: missing closing parenthesis.

PPA support would just make it easier and safer to add repositories like http://dotdeb.org to your setup. I don't see how PPAs are any worse than manually adding entries to your sources.list file. They're almost the same thing, except the former a bit more automated.

Nginx has their own non-PPA repository with latest versions, both stable and mainline.

http://nginx.org/en/linux_packages.html

The PPA is unofficial.

In addition to the main package repositories for your distro, you can add little repos that just have one or two packages in them. They get their own signing keys, so the author of a package that's not in the main repo can make their own little repo. It's a lot more convenient and a little more secure than downloading the package file from the dev's website.

How is that different from what deb-multimedia.org and virtualbox.org do with their apt repositories?

You can just run apt-add-repository <reponame>, and it will add the correct files to /etc/apt/sources.list.d/ and install the signing keys.

Not much, just that Ubuntu hosts the PPAs themselves, and it's much easier to add them than it is to add individual repos.

Isn't it the case that ubuntu compiles the packages themselves ?

This offers a measure of security agains malicious binaries ...

No, individuals can upload binary packages to PPAs.

Even if Launchpad builds the binary package, Ubuntu does not review packages' content.

The trust model for PPAs requires users to trust PPA owners, not Ubuntu.

But isn't the point of PPAs is that Ubuntu doesn't host them?

No, the point is that they are outside the normal repositories, which require testing by the Ubuntu developers, bureaucracy, etc

Reply on news.ycombinator.com