In the Closure of Madness: Spec-based Package Management with Closure-Sanity Validation
Introduction
Linux distributions split their software into packages, which together with the kernel compose a full operating system. The usual way to assemble the packages into a system is the distribution's package manager, which requires superuser privileges and a host system of the same distribution family, meaning a Debian filesystem can only be built from a Debian system. The package formats themselves impose no such requirements, since they are public specifications, and a program that follows them can build the same filesystem on any Linux system as a regular user.
In this article, we present a methodology for root filesystem initialization without superuser permissions or an existing package manager, implemented as a tool called FlatRoot. We start by exploring the packaging formats of four popular distributions, those being Debian, Fedora, Arch Linux, and Alpine. We then present the resolver, which walks the dependency graph to build the closure of package dependencies. Following, we present the post-extraction steps, which compose a sane root filesystem. Lastly, we validate the resolver against the package managers of each distribution, the validation process checks the packages of the expected closure against the real output of the package managers.