The Importance of Being Debian

Commercial Linux distributions have come and gone, but through it all, the non-commercial Debian project has forged ahead. Here's a look at where it's been and where it's going.

Eight years ago, as Purdue undergraduate Ian Murdock flipped through a Unix magazine, he came across an intriguing advertisement. It was for a Linux distribution that promised to let you run your Windows applications on the free operating system. Linux had sprung into existence a scant year before and now — according to the ad — it could support Windows applications. This seemed too good to be true. It was.

The distribution in question — Murdock no longer remembers its name — was released about a month after the WINE (which stands for WINdows Emulator or WINE Is Not an Emulator, depending on who you ask) project was launched, and it was clear to Murdock, an avid Linux enthusiast, that its claim of Windows compatibility was patently false. “There were companies springing up and selling Linux and making all kinds of untrue claims,” remembers Murdock. He was angry, and the time had come to do something about it.

There needed to be a distribution that this emerging community of Linux users could trust. And so, fusing his first name with that of his girlfriend Debra, Murdock founded what would become Linux’s most popular non-commercial distribution — Debian GNU/Linux.

In the years that followed, a number of commercial suitors had flirtations with Debian. Companies like VA Linux, Stormix, and Corel all started and then stopped commercial Debian efforts. Even Murdock himself started a company that sold a boxed version of Debian in April 2000, but he abandoned the effort in October 2001. It wasn’t until last May that Debian really made a mark in the business world. That’s when HP changed everything by announcing plans to standardize its internal Linux development on one distribution: Debian. Suddenly, the 600 or so Debian developers scattered around the world had a very large friend in Palo Alto.

To the Debian community, HP’s move did not come as a complete shock. After all, just a few months earlier, the computer maker had hired noted Debian participant Bruce Perens to be HP’s Linux evangelist. Many felt that Perens’ first action item in his new job would be to increase Debian’s stature, but Perens says he had nothing to do with the decision. In fact, it was a mild-mannered R&D manager at HP’s Fort Collins Unix labs, Stephen Geary, who, after evaluating six different Linux distributions (including Red Hat and Suse), gave Debian the nod.

As a seller of hardware, software, and services with a global business and thousands of business partners, HP felt that standardizing one internal distribution would make things easier for its worldwide network of partners and developers. The company would support other distributions, but if you were a VAR or an ISV wanting to make sure your application ran on HP Linux systems, the distribution that HP would test it on would be Debian.

“What I was looking for,” remembers Geary, “was a unifying distribution that HP could rally around, develop on, and we’d have one place where we could get together on Linux across the company.” Geary, a 14-year veteran at HP, says that in the final evaluation, the decision to go with Debian was made because of one thing: standards. With the other distributions, “it wasn’t clear who was committed to the standard, and how much they were committed,” says Geary.

Suit-Free Zone

HP’s obsession with standards harks back to the “Unix Wars” of the 1980s, when a number of feuding system vendors (including HP) helped a popular, open operating system lose the battle to become the standard desktop OS to a competitor that was years behind it technically. This competitor went on to become the most valuable monopoly the U.S. has ever known.

The Linux movement itself is, “in some sense a response to that,” says IDC Program Vice President for System Software Dan Kusnetzky. “Linux developers looked at what happened to Unix and said, ‘We’ve got to find a way to prevent this from ever happening again. Our vision was stolen from us.’ If you pushed them a little bit, they’d say, ‘Our vision was stolen from us by the suits.’”

Perhaps this is part of Debian’s appeal. A 100 percent hackers-only organization with none of the businesslike trappings of a commercial distribution, Debian is basically a suit-free zone. The distribution itself is composed of almost 4,000 software packages, each of which is maintained by one of the 700-odd Debian developers. To become a developer, you must go through a fairly involved screening process to ensure: 1) you have the technical skills required to maintain the package in question, 2) you are, in fact, the person you claim to be (this is usually done by having another Debian developer vouch for you), and 3) you intend to participate in the spirit of the Debian community. You don’t exactly have to swear to anything on a stack of source code, but if you are unwilling to abide by Debian’s Social Contract (See the Debian’s Social Contract and Free Software Guidelines sidebar, pg. 17) or buy into its Free Software Guidelines, you cannot join the team.

This screening process underlines the two driving forces behind Debian — technical excellence and the commitment to free software. It may have been the false claims of a fly-by-night distribution vendor that finally drove Ian Murdock to start the Debian project back in 1993, but he also wanted to create a distribution that adhered to high technical standards and remained true to the principles of free software, as evangelized by Richard Stallman’s Free Software Foundation (the first entity to actually sell Debian on disk). At the time, the most popular Linux distribution was the Softlanding Linux System (SLS), which was, in Murdock’s estimation, “bug-ridden and badly maintained.” He felt it was important that the Linux user community have access to a high-quality alternative.

Do You Apt-Get It?

Probably the coolest feature of the Debian distribution is its package management system. On most Linux distributions, all the files you need to install a particular application are stored in a single file (called a package) with a .rpm suffix. Debian uses its very own package format, and its package files end in .deb. Apt-get is the best of several programs you can use to manage your .deb packages.

Debian (Synaptic GUI)
Deliverance: Conectiva’s RPM-aware version of apt-get should resolve users’ RPM problems.

The cool thing about apt-get is that it does a very good job of keeping track of the other stuff (called dependencies) your application needs to use in order to run. If the program requires that the glibc 2.2.4 library be installed and that it be a version of glibc 2.2.4 that is complied by the GNU C Compiler (gcc) version 3.0, then apt-get will take care of things. If your system already has the right version of glibc 2.2.4 installed, it will know that; if it does not (if, for example your glibc 2.2.4 was compiled by the 2.95.4 version of gcc instead of gcc 3.0), then it will go out and download the correct version of glibc from the Internet.

Apt-get takes this awareness of what’s going on in your system pretty far. You can set it up to automatically update software when new versions are released, a feature that’s particularly useful for security-minded users who want to be up on the latest patches.

Now for the best part: If you’re an RPM user, you can now use apt-get for RPM files. Conectiva, a Brazilian Linux distributor, now ships a distribution with an RPM-aware version of apt-get called Synaptic (http://distro.conectiva.com.br/projetos/46). This package manager will hopefully deliver RPM users from dependency hell as more RPM files become apt-get compatible.

Freedom and Righteousness

As Linux becomes a standard part of the IT infrastructure, Debian is gaining the attention of companies with a strategic interest in a unified Linux. Hardware vendors, in particular, who see nothing but higher expenses and smaller markets in a divided Linux market, are attracted to the standard-setting possibilities of a non-commercial distribution. Back when it was a hardware company, VA Linux employed a number of Debian developers and was the distribution’s greatest flag-waver, a role that has been handed off to HP. But even companies that do not sell Debian — IBM and Compaq, for example — have their eyes on the distribution. “We think Debian is the most righteous distribution,” says IBM’s Linux program manager, Dan Frye. “It takes high-quality code from the rest of the community and then forces it through an incredibly rigorous process to make sure that it’s even more stable. So in many ways, it’s the core of the Linux community.”

Critics have complained that what Frye calls a “rigorous” process is, in fact, way too conservative. The current release of Debian at the time of this writing (the 2.2r5 “potato” release) is based on the Linux 2.2 kernel, for example; but a conservative adoption policy is not without its merits, as Red Hat 7 users found out in the fall of 2000. That was the version Red Hat shipped with a “development branch” version of the GNU C Compiler (gcc 2.96) instead of the latest stable release, upsetting many in the Linux community. The maintainers of gcc pointed out that development branches of gcc are not intended for production purposes and that any software which is compiled with the forthcoming, stable version of gcc (gcc 3.0) would simply not run on Red Hat 7.

As Red Hat’s CEO Matt Szulik explained to Linux Magazine at the time (see http://www.linux-mag.com/2001-05/szulik_01.html), Red Hat’s commercial production schedule required that it anticipate which version would be the Linux standard when Red Hat 7 shipped. “There were a lot of customers — especially international customers — that that decision impacted,” said Szulik. “We had to make one of those hard decisions, knowing that that compiler technology was going to be improved in a future iteration. So we made the decision to service our customers.”

Debian’s current project leader, Ben Collins, says that while he understands Red Hat’s reasons for releasing gcc 2.96, something like that would never happen with Debian, which for one thing, does not create release deadlines. “We don’t have stockholders to answer to and we don’t have investors. We just have ourselves,” he says.

Of course, there are some advantages to deadlines. For some customers looking for a sense of when new features might be available in the Debian distribution, the “it’ll be there when it’s ready” answer may not be satisfactory. The fact that Debian developers are not beholden to any company has its disadvantages as well. Collins says that SGI considered basing its Linux offerings on the Debian distribution but was put off by Debian’s non-commercial structure and its inability to guarantee things like 24×7 telephone support.

Because Debian is non-commercial and has never marketed itself, it has so far eluded the attention of most commercial customers. Most vendors report little or no demand for Debian within the enterprise, and the distribution’s appeal is presently confined to software developers and those in the scientific and academic settings, according to IDC’s Kusnetzky. Right now, HP is the only significant company that supports Debian. Corel’s Linux business was recently sold to an investment company which is in the process of setting up Xandros, an Ottawa-based company that will presumably follow Corel’s footsteps in marketing a Debian-based product. Xandros’s president, Michael Bego, declined to be interviewed for this article. Ian Murdock’s Progeny Systems recently decided to stop working on its own version of Debian and to instead support the “woody” Debian release and other Debian variants (including Corel Linux), “on a per-incident and contract basis.”

With a number of prominent Debian developers on staff, HP is without doubt in the best position to popularize Debian. HP is the only major systems vendor to sell and support Debian, and the fact that such a large company is so vocal in its support of the distribution can’t help but reassure conservative IT managers who are simply looking for comfort, says Kusnetzky. “The fact that HP has hired Bruce Perens and has taken up Debian will help Debian with those large organizations that are looking for a contractual partner — a business entity, not a loose organization of developers,” he says. The IDC analyst predicts that Debian will have further appeal to international customers who are looking for an operating system that is neither represented by a single company nor developed in a single country. “They don’t like the concept that a single company, such as Microsoft or IBM, or that the United States Government could tell them, ‘We don’t like what you have been doing; you can’t have this software anymore.’”

Debian’s Social Contract and Free Software Guidelines

Created in 1997 under the supervision of then-Debian project leader Bruce Perens, The Free Software Guidelines and Social Contract are the heart and soul of the Debian project. The Free Software Guidelines give a precise definition of what Debian considers to be “Free” software; it must include source code, be freely redistributable and generally unencumbered by special restrictions (e.g., Free software cannot be licensed for non-commercial use only). The Free Software Guidelines have had an enormous influence beyond the Debian project. They were copied almost verbatim to form the Open Source Initiative’s Open Source Definition.

Debian’s Social Contract contains the higher-level statement of purpose that binds all of the Debian developers together. The Social Contract must be read and agreed to by anyone who is looking to formally participate in the Debian project. The contract affirms Debian’s commitment to creating and widely distributing high-quality free software, as well as keeping the project’s bug-report database open to the public. Finally, Debian’s contract also promises to support proprietary software.

Picking Up the Debian Standard?

Hewlett-Packard has been careful to say that its support of Debian is really designed to focus attention on Linux standards. HP’s General Manager of Linux Systems Martin Fink says that Debian is like the conscience of Linux. “There’s some concern out there about things like kernel-forking and incompatible Linux versions,” he says. With Debian as a vendor-neutral point of reference, it can play, “the arbiter role,” he adds, “to make sure that everybody plays nice.”

Because of its thorough and conservative software adoption policies and its reputation as a rock-solid, vendor-neutral distribution, many say that Debian’s “arbiter role” could extend to the area of Linux standards, perhaps by making it a reference implementation of the Linux Standard Base. IBM’s Frye calls this idea, “wonderful,” adding, “A community-operated reference platform is something that we could all use.” But, Frye cautions, this is an area where IBM — with its partnerships with multiple distribution vendors — must tread carefully. “We’d rather not try to force such a thing,” he says.

Of course, Debian itself has some work to do before it becomes LSB-compliant. For one thing, the LSB has decided that RPM 3 will be the standard Linux package manager, so the Debian group will need to either change the standard or support RPM in some way before it can be considered standards-compliant. Debian developers have been looking at what specifically needs to be done to reach LSB compliance, and Collins says that it is a priority.

A meaningful LSB standard would solve another problem for Debian: its inability to attract commercial ISVs. One side effect of Debian’s focus on free software and the distributed development model is that companies seeking to work with the distribution can have radically different experiences working with the project, depending on the individual developers they happen to work with. While HP says that its positive experiences working on the PA-RISC and Itanium ports gave it the confidence to deepen the relationship, others have not been so lucky.

When the makers of the BRU backup utility, which is proprietary software, tried to get the distribution to make some changes that would allow their software to run more easily on Debian, “We were pretty much ignored,” remembers Tim Jones, president of The TOLIS Group, the makers of BRU. Says Jones, “The feeling I got from some of the responses we received was that we were a commercial vendor trying to ‘dictate’ the direction Debi-an should take in its distribution development.” Jones wound up never getting the changes he wanted, and instead The TOLIS Group maintains its own patch for the Debian distribution.

Jones says his problems would be solved if the LSB created a meaningful standard that said things like which version of glibc his application could expect to use and where in the filesystem it could expect to find other files and applications. “I live for the day that I can have one machine running any version of Linux that I can build BRU on and have it work for all other versions of Linux,” he claims.

Though some commercial companies may remain reluctant to jump into a partnership with Debian (it has its own manifesto, after all; if there’s any sure way of scaring suits, it’s by having a manifesto), it has the potential and — most interestingly — the open structure to succeed where closed-door consortiums like the Open Software Foundation have failed in the past: in bringing together a community that is united by a single operating system.

Debian’s Collins puts it best. He says that even though companies may not always agree with Debian’s heavy emphasis on free software, they can at least be fairly sure of what they’re getting themselves into. “They can look at our guidelines and know exactly where we’re coming from.”

Robert McMillan is editor at large with Linux Magazine. He can be reached at bob@linux-mag.com.

Comments are closed.