pkg2appimage VS nixpkgs

The pkg2appimage script exists to do these conversions with many examples https://github.com/AppImageCommunity/pkg2appimage/tree/master/recipes

NOTE: I've built it using the recipe available at https://github.com/AppImageCommunity/pkg2appimage, added libunionpreload from https://github.com/project-portable/libunionpreload and some additional paths to LD_LIBRARy_PATH into the AppRun, just tested on Debian and Arch Linux... and works great!

Beyond all, my work is heavily focused on compiling AppImage from existing .deb packages through the use of pkg2appimage and appimagetool, as unofficial AppImage packages not present on AppImageHub are provided, but taken from fairly reliable sources ( Debian repositories, or in some cases a PPAs for Ubuntu). The sources are available via the -a or -w options of my scripts.

Does anyone actually do that? The official documentation says not to do that (see here). Also, the excludelist mentions a couple of problems that happen when certain libraries are bundled in an AppImage.

It sounds like there might also be at least some support for portable Linux formats on Mac: snap appears to allow installing on mac via brew, but it sounds like appimages and flatpaks cannot run on mac. that said, i haven't used snaps on mac nor have I ever heard of anyone who does so... so no clue if they work well there.

PS: yes, I know that better sources for this are already available, for example the Slackware repository and woolyss, but actually the more recent version, the 97, for old i386 machines is provided by Debian (ArchLinux32 has the v90, and other versions are quite buggy for this architecture, see this issue). Unluckily there is not a 32 bit version of pkg2appimage, if we had one or someone can fork better the main script, we can still have more appimages for old architectures, being many of my scripts for x86_64 wrote to support pkg2appimage (as you have already seen in my previous post).

If I have time enough, I wanna try to create a script that automatizes all the processes, also for you developers, but my knowledge is limited to the download of packages from Debian and derivatives or from Arch Linux to create these structures, I'm not much good in compiling these programs by myself into a chroot, I'm just an enthusiast.

Depends on who makes them, but generally everything besides this list

Brave doesn't officially provide any AppImages. There is a issue on GitHub tracking this, but it's definitely not their top priority right now. You can use pkg2appimage to produce an AppImage of Brave or use existing ones available on this GitHub repository. Keep in mind that these are unofficial sources that I don't recommend to use, but if you really want to, at your own risk.

I see two signers in the top 6 displayed on https://github.com/NixOS/nixpkgs/graphs/contributors

For a single file script, nix can make the package management quite easy: https://github.com/NixOS/nixpkgs/blob/master/doc/languages-f...

For example,

```

Yes, Nix doesn't actually ensure that the builds are deterministic. In fact it works just fine if they aren't. There are packages in nixpkgs that aren't reproducible: https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aiss...

I'm not familiar with Bazel, but Nix in it's current form wouldn't have solved this attack. First of all, the standard mkDerivation function calls the same configure; make; make install process that made this attack possible. Nixpkgs regularly pulls in external resources (fetchUrl and friends) that are equally vulnerable to a poisoned release tarball. Checkout the comment on the current xz entry in nixpkgs https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/comp...

NixOS uses a monorepo and I think everyone's love it.

I love being able to easily grep through all the packages source code and there's regularly PRs that harmonizes conventions across many packages.

Nixpkgs doesn't include the packaged software source code, so it's a lot more practical than what Debian is doing.

https://github.com/NixOS/nixpkgs

In this specific case, nix uses fetchFromGitHub to download the source archive, which are generated by GitHub for the specified revision[1]. Arch seems to just download the tarball from the releases page[2].

[1]: https://github.com/NixOS/nixpkgs/blob/3c2fdd0a4e6396fc310a6e...

[2]: https://gitlab.archlinux.org/archlinux/packaging/packages/ib...

True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://github.com/NixOS/nixpkgs/blob/nixos-23.11/pkgs/tools...)

It's not the vulnerability that's a problem right now (NixOS was protected by a couple of factors) but rather GitHub's hamfisted response.

That is the problem.

We’ve noticed that some users have been asking about how to use older versions of Terraform in their Nix setups [1, 2]. This is an example of the diverse needs of people and the importance of maintaining backward compatibility. We hope that nixpkgs-terraform will be a useful tool for these users.

I think whateveracct was referring to is this link:

https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen...

What that file is doing, is building a package, and it essentially is a combination of what Makefile and what RPM spec file does.

I don't know if you're familiar with those tools, but if you aren't it takes some time to know them enough to understand what is happening. So why would be different here?