0

(Note: no disrespect whatever to the hard work people that people who run 3rd-party repositories put in.)

I came across a package repository, a ppa, that was suggested for getting php5.5 on Ubuntu 12.04. This has to be added to the list of repositories that Ubuntu knows to download software.

In general, can such 3rd-party repositories be trusted?

In this particular case, the ppa seems to be well regarded - and I would certainly want to support this and recommend it.

Is there a checklist or criteria one can follow to arrive at a decision to trust a 3rd-party repository?

The aim here is to avoid downloading malware or anything else that may damage the computer.

terdon
  • 100,812
therobyouknow
  • 139
  • +1 Yes agreed Danatela - the accepted answer at that link is really great. Only thing I would say is that the reason why I hadn't found it was the different wording of the question - so perhaps the different way I had asked the question still adds value and helps more people find it. – therobyouknow May 15 '14 at 10:58

1 Answers1

2

In my opinion, you can't technically trust a PPA. If it uploads a newer version of a certaing package, you will autmatically get the new one. By that, a PPA can technically replace any package on your system. (Source: German article on ubuntuusers.de).

When I install a PPA I look for its reputation on the web. I note down what I use it for and deactivate it as soon as I don't need the packages served by it anymore. Furthermore, I usally take a look which packages are offered by the PPA.

Another solution I heard of (which is honestly too complicated for me) is to add the PPA and install the desired package (and ONLY the package). Afterwards, one deactivates the PPA. To get updates, the PPA is activated, ONLY the desired packages are updated and the PPA get deactivated again afterwards.

Joshua Gleitze
  • 634
  • +1 Some good insights into how you deal with this, Joshua, thanks. I'll leave the question open for some others to contribute. I'd certainly follow your process - looks like a good risk minimalising approach. If you have any further thoughts on a criteria for determining if a ppa is trustworthy I'd be interested, though your point about looking at what other packages are offered is certainly a good thing to research to arrive at an opinion. Thanks! – therobyouknow May 15 '14 at 10:33