[CentOS] How to get additional packages? How secure is Yum?

Wed Jul 23 15:35:44 UTC 2008
nate <centos at linuxpowered.net>

Manuel Reimer wrote:
> Debian? Didn't they have a *pretty* dangerous hold in their SSL packages
> just some weeks ago?

Yeah, fortunately I wasn't really affected, my systems weren't upgraded
to the affected packages. (I didn't upgrade to the latest stable until
fairly recently). Shit happens, nobody is perfect. But the fact remains
that it's still supported by someone. I don't advocate debian for everyone
I was just giving an example of a distribution that has long release
cycles similar to RHEL, and a much wider selection of packages that are
actively supported by the base vendor.

> Especially if it gets to security, I don't think that Debian is a good
> solution. AFAIR they also got their servers hacked several times for several
> different reasons. Not very trustworthy, IMHO. And those political
> discussions *suck*! For example I want "Firefox" and *not* "Iceweasel".

Then don't use iceweasel, download firefox and install it yourself. It's
not hard. I don't really care either way but I do like the fact that
they back port security fixes. I did that for years myself, back in the
early firefox and phoenix days.  I haven't been on a debian mailing list
in 5-6 years so haven't seen the political stuff, but still I didn't
really care back then either.

> I'm searching for a distribution for several *months* now and so far I
> couldn't find something that fits my needs...

Maybe time to roll your own :)

> CentOS seems to be pretty well done, but the amount of packages that is
> delivered with it definetly doesn't fit all needs. Today, I tried to set up
> a server with CentOS (VMWare server). Worked pretty well, but for installing
> the NTFS driver, I had to import the rpmforge repository...

I agree, that's one of my main "complaints" about RHEL is the lack of
packages. I checked and I have about 55 source rpms that I custom build
to install on my systems(installed via cfengine), for RHEL4/5 both
32-bit and 64-bit. Back when I had to support a Ruby on Rails environment
I had to build another 30 packages for the same 4 different platforms
(for a while it was 6 different platforms) from source tarballs(made
into RPMs using alien).

Then there's custom drivers for the various kernels, e.g. for VMWare
I build from source their drivers package for each kernel so I can push
out a binary RPM along with the kernel RPM to provide correct drivers
automatically, no need to re-run the configure script and I don't like
to use their prebuilt binaries(no real reason, just prefer not to).
Same goes for fiber channel card drivers, and for a while, I had to
build/packge custom network(broadcom) and 3ware raid drivers since
they weren't supported in the main kernels at the time. (inserting
these drivers into the installation process was a pain..)

> Am I on the right list? Not very much answers, so far...

Probably because there aren't any good answers. There's too many
different preferences out there. For me rolling my own is fine for
my CentOS/RHEL systems. For others, blindly using the "main" 3rd
party repos is fine for them. Maybe for you, to lobby the distribution
you prefer most(RHEL? since your on a CentOS list) to include the
packages that you want(so they can then come down to CentOS).

Or perhaps take another approach - Don't pick the applications you
want to use and then try to find someone to support them. Pick a
base platform to use and build your system around the applications
they support.

nate