Linked by Thom Holwerda on Mon 5th Mar 2007 23:07 UTC
"rPath's Conary is a second-generation package manager. Considering that Erik Troan, rPath's CTO and co-founder, was one of the original authors of the RPM package format, some might be tempted to view Conary as an effort to do things right the second time around - nor is that view far from wrong. In its design, Conary is a streamlined version of dpkg or RPM with Yum in which all the utilities of those package managers are combined in a single command and combined with version control to meet the demands of a modern distribution."
Permalink for comment 219086
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Recent Original Stories
Recent Comments
Headlines
Random Comments
Random Stories
Random OS Link
Member since:
2005-07-08
Being always interested in online security, and frustrated with all the poor security nowadays, one of the the first things that comes to my mind when reading about new package management schemes is: how secure it might be? Or is the security of Conary related more to each individual implementation and a distribution?
Now that we have secure apt-get (Debian, Ubuntu) and other such relatively secure package managment solutions, I'm just not willing to compromise and go back to less secure solutions again. (However, OpenBSD might be a bit too much for me as a daily desktop OS though...)
Yeah, well, maybe I might be a bit paranoid to take this point of view here... - but ever heard about rootkits, spam, viruses, spambots, crackers etc...? At least I would like things to be a bit better than what they are, wouldn't you? Improving package managemnt security is one part of the bigger picture in IT security. And yeah, I do know that even a bit less secure package management systems than, for example, secure apt, may well be secure enough especially for ordinary desktop users. But - why bother to use and support anything less secure if you do have more secure (and even quite easy to use) options, and why take any extra risks?
So, does Conary, Foresight and/or rPath address potential security issues in package management in any way? Do they use signature checks (repositories, packages) or something like that? Or is security a concern for them at all?
(Edit: corrected a few typos etc.)
Edited 2007-03-06 20:00