重命名标准命名的.deb文件是否安全?

时间:2022-10-09 10:46:23

The established structure of the .deb file name is package_version_architecture.deb.
According to this paragraph:

已建立的.deb文件名结构是package_version_architecture.deb。根据这一段:

Some packages don't follow the name structure package_version_architecture.deb. Packages renamed by dpkg-name will follow this structure. Generally this will have no impact on how packages are installed by dselect/dpkg, but other installation tools might depend on this naming structure.

某些包不遵循名称结构package_version_architecture.deb。由dpkg-name重命名的包将遵循此结构。通常,这对dselect / dpkg如何安装软件包没有影响,但其他安装工具可能依赖于此命名结构。

Question:

However, are there any real situations when renaming the .deb package file is highly unrecommended? Is it a normal practice to provide a custom .deb file name for my software?

但是,重命名.deb包文件是否有任何实际情况是非常不推荐的?为我的软件提供自定义.deb文件名是否正常?

Example:

  • My Program for Linux v1.0.0 (Pro).deb — the custom naming
  • 我的Linux程序v1.0.0(专业版).deb - 自定义命名

  • my-program_1.0.0-1_amd64.deb — the proper official naming
  • my-program_1.0.0-1_amd64.deb - 正确的官方命名

Note:

I'm not planning to create a repo, I'm just hosting the .deb package of my software on my website for direct download.

我不打算创建一个repo,我只是在我的网站上托管我的软件的.deb软件包,直接下载。

1 个解决方案

#1


3  

Over the years, I’ve accumulated a large number of .deb packages with non-standard names, and I don’t remember running into any problems. “Famous” packages with non-standard names that people might come across nowadays include google-chrome-stable_current_amd64.deb and steam.deb. (In both cases, the fixed, versionless name ensures that a stable URL can be used for downloads.)

多年来,我已经积累了大量具有非标准名称的.deb软件包,我不记得遇到任何问题。人们可能会遇到的非标准名称的“着名”包包括google-chrome-stable_current_amd64.deb和steam.deb。 (在这两种情况下,固定的无版本名称确保可以使用稳定的URL进行下载。)

However I don’t remember running across any with spaces in their names; that shouldn’t cause issues with tools either, but it might cause confusion for your users (since they’ll need to quote the filename or escape the spaces if they’re using shell-based tools).

但是我不记得在他们的名字中穿过任何空格;这不应该导致工具问题,但它可能会导致用户混淆(因为如果他们使用基于shell的工具,他们需要引用文件名或转义空格)。

Another point to note is that using a non-standard name which isn’t the same as your package name (as stored in the control file) could also cause confusion, e.g. when attempting to remove the package (since the package name won’t be the same as the name used to install it).

另一点需要注意的是,使用与您的包名称不同的非标准名称(存储在控制文件中)也可能导致混淆,例如:尝试删除程序包时(因为程序包名称与用于安装程序包的名称不同)。

As a result of all this, if you don’t want to stick to the canonical name I would recommend something like my-program.deb or my-program_amd64.deb (depending on whether you want to support multiple architectures). You can make that a symlink to the versioned filename too if you want to allow older versions to be downloaded.

由于这一切,如果你不想坚持规范名称,我会推荐像my-program.deb或my-program_amd64.deb(取决于你是否想支持多种架构)。如果要允许下载旧版本,也可以将其作为版本化文件名的符号链接。

#1


3  

Over the years, I’ve accumulated a large number of .deb packages with non-standard names, and I don’t remember running into any problems. “Famous” packages with non-standard names that people might come across nowadays include google-chrome-stable_current_amd64.deb and steam.deb. (In both cases, the fixed, versionless name ensures that a stable URL can be used for downloads.)

多年来,我已经积累了大量具有非标准名称的.deb软件包,我不记得遇到任何问题。人们可能会遇到的非标准名称的“着名”包包括google-chrome-stable_current_amd64.deb和steam.deb。 (在这两种情况下,固定的无版本名称确保可以使用稳定的URL进行下载。)

However I don’t remember running across any with spaces in their names; that shouldn’t cause issues with tools either, but it might cause confusion for your users (since they’ll need to quote the filename or escape the spaces if they’re using shell-based tools).

但是我不记得在他们的名字中穿过任何空格;这不应该导致工具问题,但它可能会导致用户混淆(因为如果他们使用基于shell的工具,他们需要引用文件名或转义空格)。

Another point to note is that using a non-standard name which isn’t the same as your package name (as stored in the control file) could also cause confusion, e.g. when attempting to remove the package (since the package name won’t be the same as the name used to install it).

另一点需要注意的是,使用与您的包名称不同的非标准名称(存储在控制文件中)也可能导致混淆,例如:尝试删除程序包时(因为程序包名称与用于安装程序包的名称不同)。

As a result of all this, if you don’t want to stick to the canonical name I would recommend something like my-program.deb or my-program_amd64.deb (depending on whether you want to support multiple architectures). You can make that a symlink to the versioned filename too if you want to allow older versions to be downloaded.

由于这一切,如果你不想坚持规范名称,我会推荐像my-program.deb或my-program_amd64.deb(取决于你是否想支持多种架构)。如果要允许下载旧版本,也可以将其作为版本化文件名的符号链接。