Nineteen distribution channels later: what it actually costs to give a terminal editor away for free on Linux, and why the next step is a static musl binary that updates itself.
So what’s wrong with just releasing a monolithic static binary for each architecture you want to run it on?
I read the post, and it sounds like what the author did in the end. I just don’t get why it was the last thing he tried. I don’t get why Linux software packaging has to be so complex.
So what’s wrong with just releasing a monolithic static binary for each architecture you want to run it on?
Release engineering works on something that has only recently been codified into a SLSA scale. At the top end is nixos and their very firm validation of code all the way along the supply chain.
At the bottom of the scale, a SLSA score of 0, is “here’s a monolithic binary I found on the website of someone on the interwebs. Even though we don’t know how it was built, nor can we reproduce it or confirm it’s what he built or look at any of the parts to see whether the statically-linked libraries are now at-risk, let’s just run that.”
You … do see how irresponsible that is on every level, right?
Like, 20 years ago I dropped a patch in for Apache, and these days I manage reams of machines using apache, sendmain, winbind, nginx, postfix, etc; to manage those without a proper infrastructure is absolute madness.
So what’s wrong with just releasing a monolithic static binary for each architecture you want to run it on?
I read the post, and it sounds like what the author did in the end. I just don’t get why it was the last thing he tried. I don’t get why Linux software packaging has to be so complex.
Release engineering works on something that has only recently been codified into a SLSA scale. At the top end is nixos and their very firm validation of code all the way along the supply chain.
At the bottom of the scale, a SLSA score of 0, is “here’s a monolithic binary I found on the website of someone on the interwebs. Even though we don’t know how it was built, nor can we reproduce it or confirm it’s what he built or look at any of the parts to see whether the statically-linked libraries are now at-risk, let’s just run that.”
You … do see how irresponsible that is on every level, right?
Like, 20 years ago I dropped a patch in for Apache, and these days I manage reams of machines using apache, sendmain, winbind, nginx, postfix, etc; to manage those without a proper infrastructure is absolute madness.