Why Gentoo?

Multiple times in the past I’ve been thinking of how Gentoo is perceived by the wider public, the non-users. What probably stands out most is compiling. Almost everyone who heard of Gentoo knows it has something to do with compiling everything. And why are we doing that? Well, besides being hardcore, the common sentiment goes for performance. So yeah, Gentoo users must be some kind of hardcore ricers who try to squeeze every last bit of their system performance. To be honest, I don’t think that’s a good way to describe Gentoo. Yes, compiling is at the core of it. But performance? I don’t think so, at least not in the obvious, -O9999 -fzomg-fast way. The world has moved on, CPUs have gotten faster, optimizations have gotten smarter, and distributions have started optimizing more aggressively. Optimization-wise, I suspect your average Ubuntu package with generic optimizations may be no slower than the equivalent Gentoo package fine-tuned for your CPU. And if it’s not, then it probably won’t make a real difference anyway. There’s much more to Gentoo than that. Yes, some of it comes from building from source: the flexibility. But a lot of it comes from the wider Gentoo philosophy, the philosophy that brought us all together. The idea that Gentoo is the distribution we’re making for ourselves and people who enjoy Gentoo. So if I were to make a few arguments for Gentoo, I’d focus on that. And this is what I’d like to do here.

Gentoo aims to be independent There is no company behind Gentoo. There is no business model. It’s all made and governed by people dedicated to the values behind Gentoo. A few of us may be working on the distribution as part of our dayjob, but the vast majority (myself included) are just volunteers. We are driven by passion, and not by profit incentive. And if that wasn’t enough, we’re good at making Gentoo as unprofitable as possible. The infrastructure behind Gentoo is partially donated, and partially paid for by donation money. We’re not putting all our eggs in one basket. No single donor can hold Gentoo hostage.

In fact, we’re currently disbanding Gentoo Foundation in favor of SPI to reduce the risk of direct financial governance becoming a choke point. Gentoo aims to be secure Security is important to us. We are doing our best to keep Gentoo packages secure, often going ahead of upstream in backporting patches. We have a dedicated security team who helps everyone track the problems, resolve them and keeps our users informed. We are maintaining our own infrastructure to reduce the risk of being hijacked. We are securing our distribution channels and mirrors using OpenPGP (and yes, it’s the best tool for the job, backed by our own infrastructure). We are only using Codeberg (which we really appreciate) and GitHub as optional mirrors and contribution channels, and we aren’t making Gentoo dependent on either. Sure, abandoning them would be inconvenient for us, but we can do that if need arises. We have very strong QA policies, often in discord with upstream decisions. Bundled dependencies? Not on my watch. Static linking? No, thank you. Pinned dependencies? Let me try removing these pins. Or well, at least we try. As the quality of software development is dwindling, we do our best to prevent the most obvious threats, such as severely outdated dependencies. Gentoo aims to be made by humans We banned LLM contributions two years ago, and never regretted it. We didn’t “wait and see”, we took decisive action, and if we got left behind, it’s only for the better. I can’t give you a 100% guarantee that no tainted code slipped through, but we’re doing our best to stay vigilant. In the end, it’s all about trust, and trusting one another is what builds our community. Unfortunately, in today’s LLM-ridden world we can’t stop slop software from being packaged in Gentoo. We have an important commitment to deliver up-to-date and secure software, and that often means accepting the fact that upstreams haven’t taken the stance we did. Nevertheless, we try to keep the worst offenders (like copywashed chardet or vibe-coded cryptography software) at bay. Gentoo aims to be stable Gentoo might not be the easiest distribution to start with, but once you set it up, it is surprisingly stable.

Of course, mishaps do happen; but when they do, you can usually fix them without having to reinstall the system. One of the unique features of Gentoo is that the package tree isn’t bound to a single version of any given package. If you discover that a new version doesn’t work well for you, you have a good chance of being able to downgrade. Even if the version in question is gone from Gentoo, restoring it is relatively easy. Gentoo is a rolling release distribution. It’s not split into multiple versions, requiring you to periodically move to the next release. All package versions are at your disposal; you can choose to run a bleeding edge system and get new packages as soon as we add them, or you can choose to run stable, and upgrade once we confirm they’re ready. Or you can customize your system beyond that.

Honestly, whenever Gentoo comes up for me, I end up praising the stability. I run ACCEPT_KEYWORDS="~amd64" in my make.conf, so I get pretty frequent updates. I run an LLVM profile with mold as my system linker and LTO enabled for everything. Even with all that, I have a more stable experience with Gentoo than I’ve had with basically any other desktop Linux. Sure, sometimes I find myself opening a cursed issue on b.g.o, but my system hasn’t ever broken! The work the Gentoo devs put in to make sure everything is stable and everything works well across many different setups is incredible, and the stability that comes with portage sure doesn’t hurt either. demize @ unstable.systems

Gentoo aims to be flexible Gentoo is a source-first distribution, which means the primary method of installing software is to build it from source. Of course, that doesn’t mean manually building stuff, following some kind of how-to: finding all the dependencies, installing them manually, going through a series of magical incantations, and eventually ending up no better than if we were installing a binary package. The package manager takes care of all the necessary steps and more, making package installs easy; well, at least unless something fails. But I’m digressing… The key advantage of building from source is flexibility. You have better control of how packages are built and what features they include.

You optimize for what you need, and that’s where you can find both real performance improvements and attack surface reduction: think of building your RSS reader or your mail client without a fragile web browser component that you don’t care about at all. And that’s just the beginning. Compiling from source means that you aren’t limited to one set of libraries that our builders used. This is for example why you can stick with an older version of a given library (or take advantage of a newer one), or perhaps use a different implementation entirely. There are limits to what’s officially supported, and there are limits to what’s actually going to work, but the potential is much wider than with a pure binary distribution. And even beyond what’s supported, you can easily apply patches or adjust the build process. Some people like to say that “Gentoo is about choice”. However, I wouldn’t put such a strong emphasis on this. There are cases when we can provide reasonable choice such as the heated OpenRC vs. systemd argument, or glibc vs. musl (another case where building from source helps), but it all depends on people actively supporting all the options; otherwise you end up with a half-broken system. There is a number of cases where we had to give up because the maintenance required too much effort, such as LibreSSL vs. OpenSSL (notably with Qt rejecting to support LibreSSL upstream), or libav vs. ffmpeg.

I appreciate Gentoo’s flexibility and stability. I can use the same OS on different architectures, different libc, different init systems, patch packages, configure features, different display stacks, and then keep everything up to date. Portage lets me do anything I want and then keep it maintained with minimal work. charon @ hachyderm.io

And what’s perhaps equally important is that almost all of this “choice” is opt-in. While we want to provide flexibility whenever people need it, we also want to provide good defaults. Ideally, you should be able to customize what you care to customize, and leave everything else at the default, and have a good experience.

My favorite thing about Gentoo is that it lets me decide how things should work, and try new things. It’s like LEGO compared to a model kit. Do I particularly care which NTP daemon my system uses? No, but I do care that I could change it if I some day decided I wanted to.

I do care that it’s not some weird or obscure choice to install a headless system with no graphics packages at all, or to build my graphical stack exactly the way I want it, and the difference is just simple configuration files that I control and can change at any time, not an entirely different install process. And I do, of course, love that I can turn up the optimizations to wring every last processor cycle out of my hardware. In the (distant) past, using Gentoo and being able to compile my own custom kernel and graphics stack was the difference between being able to run 1080p video smoothly on ancient hardware when Ubuntu could barely play a video file at all, saving me hundreds of dollars on hardware. Josh @ babka.social

Gentoo aims to be fun There is more to enjoyable experience than just getting the job done, and Gentoo aims to enable you to take that extra step. Do you want to try the latest bleeding edge software? Sure, we got you covered. We often provide versions from all of the upstream stable, testing and development branches. For many packages we supply “live” ebuilds that build straight from the upstream repository, making testing the latest development branch as simple as unmasking them. For other software, they are trivial to create yourself. Are you bored of a plain GNU/Linux system? Well, you can try musl instead. Or maybe play with GNU Hurd. Or replace the GNU toolchain with LLVM to various degrees. Back in the day, we even had a FreeBSD remix (and I’d love to see it again, if someone has the time and energy to work on that!). Or perhaps you’d like to try FreePG in place of GnuPG, or Sequoia. Or Samurai in place of Ninja, or libarchive tar/cpio, or one of the alternative awk implementations. Or maybe you find GNU coreutils too secure, and want to try some RIIR instead. The sky is the limit (or your patience, more likely)! And the best part is, this does not contradict stability at all. It’s all opt-in. The starting point are the stable or ~arch packages. You can choose to add some bleeding edge experience to that, or perhaps pin to some LTS branches where necessary. You can keep to the defaults, or start exploring alternatives (some stable, others bleeding edge).