Use latest calibre release? Or the packaged Debian version?

[eschwartz]

Originally Posted by signum

The official Calibre upgrade is always complete in itself. It doesn't depend upon any previous release. It has all the stuff it needs to run (specifically, the minimal needed Qt5 libraries and others), as if it were a complete new install. The Calibre library isn't touched but used if found, nor is the user configuration directory, also used if found, which is buried in a "hidden" directory underneath your home directory. New versions come out every Friday, not because Calibre is so buggy, but rather due to active development of new features. Many people scan the "what's new" web page (essentially, a change log) to see if anything changed that they might be interested in. If not, they will skip that week's update. If you find a bug, Kovid often fixes them within a day, sometimes within hours, and it will appear in the next Friday's update. I call this an extremely high level of support.

The most important thing to remember re: upgrading multiple versions at a time, is that any database schema updates will be (IIRC) applied sequentially from whichever point needed, and that is pretty much the only configuration related upgrade needed (while the binaries themselves are, as you pointed out, refreshed from scratch).

[kovidgoyal]

Originally Posted by eschwartz

I hope it is safe to assume they get properly vetted the first time even if later they slack off due to overload

It actually isn't. It is simply impossible for spare time volunteers to review an entire decent sized codebase for malicious code. In the case of calibre, a potential reviewer would need to read over half a million lines of code. That would take man months of mind numbing effort. I simply do not believe distro maintainers do that. You could ostensibly hire someone to do that, but even that does not really work, witness all the malware in the mobile app stores despite <large companies> efforts to review submitted apps.

Instead what happens in the typical distro for a typical application is that some app becomes popular, a distro's users typically contribute a user created distro specific package, the distro's maintainers then decide to use that as a base to make an official package. Depending on the distro, some maintainers will then try to review the package for compliance with licensing terms and do a quick automated search for common security/stability red flags. And then pull the trigger. Nowhere in this process is there even a hint of an effort to actively search for malicious code, which would likely be well camouflaged in any case.

Of course I may be completely wrong and the distros might actually have access to an army of house elves to review hundreds of millions of lines of code, but, I would be very surprised if that were the case.

[eschwartz]

Of course, see my user title.