Managing Google’s Packages
Stephen O’Grady suggests that Google providing their own package repository may herald a future of ISV-managed repositories as part of a trend of distributing the power of the distribution maintainers. I hope not.
The problem with the strategy of providing your own repository is that you’ve lost one of the biggest advantages of a package management system.
The three main benefits of a package management system are, in short, (a) ease of discovery, (b) ease of installation, and (c) ease of maintenance. Given that quite a few applications (on every OS) come with automatic update mechanisms (e.g. “check for updates on startup”), item (b) isn’t a hugely differentiating factor. Item (a) really only exists because everything is already there when you install the OS. You don’t have to find the ISV’s website to download anything, since the package management system already knows how to find it (e.g. just type in “Ruby”)… which is not at all the case with ISV-managed repositories. That leaves you with ease of installation, and I do not think the process of setting up Google’s repository in, for example, Ubuntu qualifies as “magic.” If users start getting lots of their software from Google’s repository (perhaps even software only hosted, but not developed, by Google), then the one-time installation cost is fine. But that takes you right back to centrally-managed repositories vs. ISV-managed ones.
No, I think what Google has done here is a very practical avoidance of writing their own automatic update routines into every piece of software they write. It makes good sense, but I don’t think a proliferation of ISV-managed package repositories represents an appealing future of supposedly easy software discovery, installation, and maintenance.
in addition, there are fundamental questions of trust posed by the commercial repositories. i “trust” – for lack of a better term – the individual communities to package only the necessary software. that trust probably extends to Google as well, for the time being. but every vendor? i think not.