news
Review: Package Forge and Soar
Quoting: DistroWatch.com: Put the fun back into computing. Use Linux, BSD. —
Often times new package managers for Linux fall into one of two categories. One camp wants to make a giant repository of their new, universal format, accumulating as many packages in one place as possible. We can see tools such as Flatpak and Nix fall into this category where we end up with a massive third-party repository that can work across most distributions. Another approach is to try to bring multiple existing package managers under one umbrella, creating a meta-manager. The Rhino-PKG package manager does this on the command line. Some graphical package managers, including Discover and Mint's software centre, do this too.
The soar utility is taking a third approach that attempts to use one package manager to handle multiple formats from multiple locations. It appears to be trying to make order out of the chaos that is the Linux community, by gluing the various formats and repositories together.
It may be too early to determine how well the soar team is doing. On the one hand, soar is fast, it has great documentation, and it worked unusually well for me. There was no need to configure anything, build anything, or run install scripts. Everything soar needs is built into its single binary. This is convenient, especially if you are are a regular user and do not have admin rights on the system. A person can download soar and place executable files under their home directory without needing any special access or tools.
On the other hand, soar has two things which I feel are working against it. The first is that its default repository is small. It may grow with time, but it is a lot of work to get enough packages to attract users who will then want to add more packages. A software manager usually needs to hit a critical mass to be practical for people to use, and soar is not there yet. The developers will probably need to package many more pieces of software and include software not readily available elsewhere to make soar attractive.
I'm also a bit concerned about what, if any, verification is happening. One of the big benefits to using central repositories, such as traditional distribution repositories, is the knowledge that someone had to at least download, test, and build the source code which went into the final package. Many, though not all, packagers review source changes and watch for potential bugs or exploits. I briefly looked through the Package Forge collection and a lot of it seems to be pulling from all over the place, including (I think) AppImage files. Which makes me wonder who, if anyone, is testing and verifying the safety of the 272 packages currently available? I think this is a problem with tools which try to glue together multiple sources, it adds a layer we need to trust. Maybe it is safe, but I didn't find any way to verify builds or a chain of trust between the original source and what soar installs, something major distributions usually provide.
The soar utility is fast and easy to use and, in my experience, free of bugs. Time will tell whether that is enough to attract people to its approach to managing software.