The binary package has been built by your vendor and has generally had a fair amount of testing. By building from source, you lose most of the advtantages of your packaging system, specifically:
- The packaging system lets you verify the integrity of installed packages using checksum.
- The packaging system is aware of dependencies between packages and can automatically install the necessary additional software to make things work.
- The packaging system lets you conveniently remove a package, whereas most source installs don't really provide a good uninstall mechanism.
- Using packages means it's very easy to install an older version of the package of there are problems with the new version.
There are certainly some advantages to building from source -- for example, you may require a different configuration than provided in the vendor package. However, even if you elect to compile the code locally, it's almost always a better idea to create a package from it and install it using the normal packaging tools for above reasons (rather than running
make install directly into your filesystem).
What's the best technique to make sure not to compromise a production server due to an update?
Test the updates in your development environment to make sure they work as expected before deploying them on your production system. Ensure that your development environment accurately reflects your production environment.
This is true regardless of how you choose to install the updated software.