Ubuntu – Backup Software Sources

Well because I like mucking around with command line scripting, I've written the following. It generates a list of PPA strings that you could backup and then script into add-apt-repository:

grep -RoPish '(?<=ppa.launchpad.net/)[^/]+/[^/ ]+' /etc/apt | sort -u | sed 's/^/ppa:/'

That'll generate something like:

ppa:ubuntu-wine/ppa
ppa:am-monkeyd/nautilus-elementary-ppa
ppa:nilarimogard/webupd8
ppa:ubuntu-x-swat/x-updates
ppa:tualatrix/ppa
ppa:banshee-team/banshee-unstable
ppa:chromium-daily/beta
ppa:libreoffice/ppa
ppa:banshee-team/ppa

If you ever wanted to blanket-restore those, you could pipe them back into the system like so (assuming we saved the PPAs to ~/ppa-backup.txt:

<~/ppa-backup.txt xargs -I % sudo add-apt-repository %

I would probably suggest you don't just restore them all. Look through the backup and make sure you know what each PPA contains.

• Reliability:
  • When installing from a tarball, software may try to overwrite other software. Build dependencies are needed, and the process has a high failure rate. If you are installing software that packages in the repositories depend on, this will not satisfy that dependency since it is not registered with dpkg, unless you use checkinstall to temporarily convert it to a debian package. With this, you do risk breaking dpkg. Even if the code is open-source, unless you make sure it hasn't been changed, you should still download it from a trusted site. You can install multiple versions of software, as long as it uses different directories. You can override this in the makefile.
  • Using a debian package will ensure files do not overwrite those of other programs, however, if using sudo dpkg -i file.deb, dependencies must be installed first. When installed this way, you won't get updates unless the package is also in the repositories, but this package will satisfy dependencies requiring this software. It will also most likely give this package a menu entry or at least register manpages. Debian packages usually are tested with Lintian which makes sure packages meet or exceed a set of standards that can be quite stringent, going as far as whether certain files have any executable code or not. Multiple versions of the same package cannot be installed. A badly made package can fail to install, fail to remove, or even break DPKG, leading to difficult repairs, frantic searches for backups, or even a reinstall if the problem is serious.
  • Using apt is the best option when possible. Dependencies will be automatically fetched and installed, and packages are built using reliable build server configurations at launchpad, minimizing failures. Packages can be searched through aptitude or other such tools, and updates will be easily facilitated via the update manager. Since dependencies also come from apt, the package is more likely to interact with dependencies properly. Packages are tested via Lintian as with debs, but the testing, combined with highly stable build servers, make for even more stable packages. Since the packages pass through Ubuntu's build servers, most likely they will be tweaked to integrate with the rest of the OS. Multiple versions of the same package cannot be installed. Since Ubuntu's build servers are used for PPAs, there is less change you'll break apt due to auto-linitianing.
• Updating:
  • With a tarball, you will get no updates, unless the program has its own check for them. With that, you will need to install such updates manually, and they won't be consolidated in a single place. You will probably be able to get nightly or even current source code in a tarball to compile and install. If you need bleeding-edge code, that may be useful.
  • With debian, packages will only be updated if you have the repository for them. Developers will most likely make debian packages a bit behind the bleeding edge source, but betas are often found with debs online.
  • With apt, packages will be updated very easily. Updates are consolidated in one place, the update manager, and are done automatically or semi-automatically. Unless you are on an alpha or beta of Ubuntu, you will be using well-tested versions, even if they are a version or two behind the current upstream source. Security updates will be pushed as soon as they are lightly tested to make sure they don't make the situation even worse. This means that your security will be protected with timely updates, but these updates will be checked to avoid data loss.
• Security:
  • Tarballs are not digitally signed in any way. They may be mangled or modified by malicious third parties. Even if you do a hashsum(Avoid MD5), you should still trust the owner of the site and the author of the package, since they provide SHA- or MD5-sums.
  • Debian packages are not signed, however dpkg will not allow a debian package to overwrite the files of another, so a malicious deb can't destroy init or mess with bash by overwriting it. You should always trust the website and the author of the package.
  • apt uses signed keys for repositories, so they can;t be mangled without a red flag coming up. PPA uploads are digitally signed so non-owners of the PPA cannot put up broken or unsafe packages. The no-overwrite for files of another package is also enforced. Of course, you should trust the PPA or repository owner, as unchecked packages with malicious code will execute upon being run.