A spotter’s guide to open-source Linux package formats

David M Williams
Wednesday, 16 January 2008 18:14

Opinion and Analysis

It’s generally safe to open up any archive but you do need to exercise a bit of care to avoid clobbering any files on your system. Sometimes the tarball extracts all its files to a subfolder which it makes in your current directory. However, sometimes it extracts everything to the current directory – this can be a nuisance because you have to clean up, but it can also destroy any files you have with the same names.

Worse, some naive administrators may extract tarballs in inappropriate places like the very root of the system; a malicious archive can easily replace important system configuration files or executable files in this way. It’s best to extract an archive as a non-privileged user in a dedicated folder and move any output into place afterwards.

So, let’s open it up. Again, we’ll use tar:

tar –xf mysource-2.16.2.tar

or, as before, add the –z flag to skip the gunzip step:

tar –xzf mysource-2.16.2.tar.gz

You now have a folder with all the source code available, as individual files and folders, just as if it was on the designer’s system itself.

Tarballs are the most common archive format but not the only one; you might come across cpio archives which generally end in the .cpio suffix. This format is used internally by rpm packages but is not usually a common archive format anymore by itself. However, if you find one note that it while cpio uses some of the same flags as tar, it works on input and output streams not files, like so:

cpio –tv < examplefile.cpio

to inspect the archive and

cpio –i –d < examplefile.cpio

to pull out the contents.

However your archive file comes to you, the onus is then on you to compile and install the software. This is the most portable format; no matter your Linux distro it’s a pretty safe bet the app will co-operate provided you know what you’re doing. (Happily, “what you’re doing” can usually amount to a series of commands –

./configure
make
make install

provided the developer has been kind enough to provide a configuration tool and Makefile.

By contrast, package managers are far more sophisticated and friendly – but are much less transportable between different distros. However, the advantages they offer are many. A package manager will keep track of what has been installed and where the files are located. The package manager will also help you easily find if new versions are available, and best of all will make sure any dependencies are conformed to. If you try to install a package which relies upon a crucial component to run, the package manager will ensure the right version of that crucial component has also been installed.

The two most common package formats are the Debian Package format as used by, of course, Debian but also Ubuntu, Knoppix and others – as well as the rpm format used by Red Hat, Fedora, Suse and some others.

Unless you’re making your own Linux distro the choice of package manager has already been made for you. I’ve long tried to stress the difference between Linux distros is pretty much the package manager it employs and the default set of packages it installs – every version of Linux uses the exact same Linux kernel, and pretty much the same GNU tools – but one major point of distinction between distros is the package manager.

CONTINUED