Software maintenance is conceptually pretty straight-forward.
As new features are added or bugs discovered, the provider of the operating system or applications bundles together the files needed to add the feature or correct the bug and makes them available.
The bundle of files is then installed to add the feature or correct the problem and possibly some additional commands are run to adjust configuration information as needed by the newly installed files.
Depending on the installation tools used, the bundle of files may also be checked for correct installation and authenticity as part of the installation process.
Some vendors group bundles together into larger groupings. For example, Sun calls the groupings of Solaris packages, clusters, while Red Hat names their groupings for the type of system (e.g. server, client, laptop, etc.).
A configuration is the term often used to describe a particular suite of packages such as the suite of packages one might install on each of a group of similar systems or the complete suite required packages needed to set a system up as a web server or print server.
The difficulty in performing software maintenance comes in four areas.
First, there is not much agreement on the format for bundling files.
Second, various bundling formats require specialized installation, removal and management tools. These tools are different between vendors, and offer differing feature sets.
Third, updates, often overwrite configuration files, reset values to defaults, add users, turn on services, or perform other actions that causing working software to fail, or security to be compromised.
Finally, there is the chore of keeping track of which updates have been installed and which of the available updates need to be installed.
The simplest of the software package management tools are the simple archivers such as tar, zip and cpio.
These common archiving tools are found on both UNIX and Windows and are used to create and install files from their corresponding archive formats.
Macintosh users will be familiar with Stuff-It tool for archiving files on that platform.
While tar, zip, cpio and other archive tools have the advantages of being cross platform, commonly used and readily available, they lack a number of features commonly found in tools specifically designed for software package management.
A typical suite has commands to install or update packages, inquire about which packages are installed and remove packages.
Dependency checking is an important feature for a package installation tool as many UNIX packages are modular, built on top of libraries found in other packages.
Verification is the act of checking that the package is installed correctly and the files in the package match those installed. This can be used to check for possible tampering that may have occurred due to a break-in or to check that file modes or ownerships have not been changed my mistake.
Another aspect of assuring system security when installing packages is the determination of the authenticity of the package being installed. This is especially important when using packages and patches downloaded over the Internet.
Listing the installed packages and removing packages are common features across all of the package installation tools.
It would be terrific if every software package management tool or tool suite had all the features needed.
Unfortunately, nearly every installation tool suites lack one or more features. This can be worked around by combining the installation tools with other commonly available tools.
The easiest (missing) feature to compensate for is Internet access.
Most vendors provide access to software packages and patches via ftp, the web or both.
Internet available packages and patches are often further packaged into one of the several common formats for download and will need to be unpacked from their distribution packaging before they can be installed.
Installing a package is often times not the end of the job for the system administrator.
A wide variety of software packages require some degree of local customization, configuration, licensing or user level setup to complete the installation process and present the user with the fully functioning tool they expect.
Since every package will have its own customization and configuration needs, the system administrator will need to read up on the specifics of the packages in use at his site.
Even packages that are installed by a package installation tool often have configuration files that will need to be modified. These files can modified to suit local conditions and then distributed using a tool such as rdist.
Wrap a short shell script around a package to set needed variables.
Many packages require setting environment variables or adding elements to a shell’s execution path. Instead of having each user make the needed changes, one approach is to replace the program with a short shell script that sets the environment as required.
For packages that contain several tools, all of which require special environmental variables or modifications to the user’s execution path consider adding the needed setup information to the skeleton files used to create the user’s accounts.
Employ a specialized user environment configuration tool such as modules.
The modules tool provides the means for the system administrator to package up the environment variables, PATH and other user environment changes into modulefiles that can be easily loaded by a user to configure their environment to suit a specific package.
The modules tool performs complex tasks such as removing and reordering elements of the user’s execution PATH to allow even differing versions of the same package to be configured correctly.