debs

BTW, you should release some generic binary tarballs, those debs work just fine on CentOS/Fedora if you unpack them.

Are there now a bunch of.debs for useful things other than writing haskell that are actually written in Haskell?

If you're downloading rpms/debs, verifying the signatures, and you trust the signer, then you're probably fine.

And those companies might be completely justified because the benefits of Docker versus Amazon AMIs/RPMs/DEBs/etc.

Mixing pip and debs loses some of the advantages of having a standard system, though.

It can make signed DMGs on MacOS, EXE/MSI packages on Windows, DEBs/RPMs/tarballs on Linux etc.

If you're downloading random unsigned debs/rpms from the internet and installing them, then you're just as wrong as downloading/execing a binary.

You are now mixing debs, click packages, apks, app manifests, and RPMs from Sailfish on one system.

Python.debs are supposed to depend on separate python module packages, not bundle everything.

I guess it's true that one wouldn't be able to just install debs on RedHat, for example, without modification.

Do you expect Redhat and Debian to give up rpms and debs?

Both debs and rpms can be signed with GPG keys.

The real problem comes with people thinking that "these two distros both use [package standard] so I can take a system package only provided on one, and just install it on the other!" The difference between the world of RPMs and the world of DEBs isn't really the package format standard; if that was the only problem, it would have been solved long ago.

Debs and Rpms are fine for configuring the machine, as soon as you have it where machines and application services aren't a 1:1 relationship that will lead you in the direction of dependency hell.