port "cask" -- installing prebuilt binaries

[Arno Hautala]

> On 6 Aug 2020, at 11:03, Craig Treleaven <ctreleaven at macports.org> wrote:
> 
> So, pretend I don’t know how Homebrew’s cask system works.  (I don’t.)  
> 
> 1) As a user, what is the advantage of this kind of system versus other avenues for software (i.e. the Mac App Store or direct download of a dmg from the developer web site)?  Doesn’t most such software include an auto-updater?  If so, won’t that conflict with MacPorts update handling?  A potential disadvantage would be the time lag from a new version being released until a new ‘cask’ is available, right?

It basically becomes _an_ App Store for software not in _the_ App Store. I don’t know how homebrew handles this either, but I think installing the software with MacPorts and then updating it on it’s own would either break the MacPorts install, or MacPorts would need to try to detect this and “repair” it by reinstalling or updating the MacPorts database with the updating files. Neither situation sounds ideal. I don’t know that there’s going to be an easy way to disable the auto-update features other than user education.

> 2) My impression is that developers of commercial software would, in many cases, NOT want a third party (like MacPorts) to be distributing their software.  From their perspective, a third party introduces considerably more risk that users may end up with maliciously altered software.  Can we not expect to get takedown notices from certain publishers?

I can both see a difference and at the same time question what the difference is between mirroring source archives and binary archives. I think a clear line could be whether the software is released with any sort of open source license.

> 3) Is the MacPorts mirror network willing to contribute bandwidth for distributing non-open source software?  Will we sour our relations with some of the mirrors if we use/abuse their bandwidth this way?  Why do we want to use our bandwidth that way?

I would expect this would be reasonably similar to how source archives are currently handled. Have any developers asked for source not to be mirrored?

-- 
arno  s  hautala    /-|   arno at alum.wpi.edu

pgp b2c9d448