Fedora Planning To Introduce Major Package Management Changes Next Year

[phoronix]

Phoronix: Fedora Planning To Introduce Major Package Management Changes Next Year

While during these crazy times it feels like Fedora transitioned from Yum to DNF yesterday, it's already been a half-year since the DNF package manager has been the default on Fedora. Next year with Fedora 38 they are looking at further evolving package management by way of MicroDNF...

https://www.phoronix.com/scan.php?page=news_item&px=Fedora-38-MicroDNF

[AsciiWolf]

One notable change is that the removal of a package will no longer trigger the removal of unused dependencies.

Oh no. This was a big downside of PackageKit (until recently where it finally got fixed and will hopefully be also fixed in GUI GNOME Software in F37) and now it will be broken again in MicroDNF. I hope they will be able to get this sorted out soon.

[mrjonez]

Relocation of internal databases and different structure of internal databases

• (...)
• Packages installed by another packager will be handled as userinstalled
  • Consequence => The removal of a package will not trigger removal of unused dependencies

It seams to only apply when removing a package installed with a different packager.

[Volta]

One notable change is that the removal of a package will no longer trigger the removal of unused dependencies.

The removal of unused dependencies is the preferable sane behavior of package manager. I hope there will be an option to use this functionality?

[RahulSundaram]

The removal of unused dependencies is the preferable sane behavior of package manager. I hope there will be an option to use this functionality?

The post here has left out a crucial portion of the change proposal

• Packages installed by another packager will be handled as userinstalled
  • Consequence => The removal of a package will not trigger removal of unused dependencies

[caligula]

Yay. Btw DNF has been the slowest of them all https://michael.stapelberg.ch/posts/...gers-are-slow/

[uid313]

I would like all executable binaries to be signed with a digital signature so that when you run a program it can check the signature before it executes.
On Linux you can execute any binary whether it is trusted or not.
On Windows you can can execute signed binaries but if you try to execute an binary that isn't signed you get a prompt that informs you that it is not signed and lets you decide whether to execute or not.

[cl333r]

Yay. Btw DNF has been the slowest of them all https://michael.stapelberg.ch/posts/...gers-are-slow/

DNF is written in Python, if their new MicroDNF was written in Go it would be about as easy to code but much snappier.

PS: I'm not saying everything is due to the language, but a lot is.

[cynic]

I would like all executable binaries to be signed with a digital signature so that when you run a program it can check the signature before it executes.
On Linux you can execute any binary whether it is trusted or not.
On Windows you can can execute signed binaries but if you try to execute an binary that isn't signed you get a prompt that informs you that it is not signed and lets you decide whether to execute or not.

If I understand your request, I think this was covered some time ago here: https://www.phoronix.com/scan.php?pa...7-Signing-RPMs

EDIT: no, ok! I've reread your request and you were talking about binaries and not packages! sorry

[cl333r]

I would like all executable binaries to be signed with a digital signature so that when you run a program it can check the signature before it executes.
On Linux you can execute any binary whether it is trusted or not.
On Windows you can can execute signed binaries but if you try to execute an binary that isn't signed you get a prompt that informs you that it is not signed and lets you decide whether to execute or not.

Not an expert but on Windows it's because of the inherent lack of security they had to devise such a thing.

Though something similar is implemented to .desktop files where the desktop environment marks the ones allowed for running on double-click, afaik it's not a standardized approach.