Installing Python Packages in Debian: A Security Concern?

The process of installing Python packages in Debian can be a complex one. With the rise of proprietary software, it's become increasingly important to ensure that the packages we install are trustworthy and secure. One common approach is to integrate dependencies into the package itself, but this raises concerns about security and bypassing the repositories system.

Debian Packages: A Middle-Ground

In some cases, a middle-ground between fully integrating dependencies and not including them at all can be achieved by using Debian packages. This approach allows for the inspection of the final product and ensures that the user has control over the installation process. However, it's not without its limitations.

The pip install command is typically included in the Debian rules file, which is executed when debuild or dpkg-buildpackage is issued. This means that dependencies can be downloaded from PyPi during the build process, rather than at install time.

Integrating Dependencies at Build Time

Another option is to integrate dependencies only at build time, within the source package. However, this approach has its own set of drawbacks. For one, it requires fiddling with DEBIAN/postinst and issuing a wget or pip install command. This can be seen as an approach that bypasses the repositories system, which is not ideal.

Flash, Oracle Java, Steam, and others have taken a similar approach by downloading additional software from untrusted sources behind the scenes. This raises serious concerns about security and user trust. By integrating dependencies at build time, the purpose of a packaging system that handles dependencies, updates, and versioning is defeated.

In conclusion, installing Python packages in Debian requires careful consideration of security and trust. While integrating dependencies into the package itself may seem like an easy solution, it raises concerns about bypassing the repositories system and compromising user trust. A middle-ground approach that allows for inspection of the final product and control over the installation process is a safer and more trustworthy option.

Debian install python