Public SourceMage Discussion List

[Arwed von Merkatz <v.merkatz AT gmx.net>]

On Fri, Sep 02, 2005 at 04:29:24PM -0700, Eric Sandall wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Fri, 2 Sep 2005, Flavien Bridault wrote:
> >Le vendredi 02 septembre 2005 ? 16:15 -0500, Jeremy Blosser (emrys) a
> >?crit :
> >>On Sep 02, Flavien Bridault [f.bridault AT fra.net] wrote:
> >>>I didn't say that our developers do a bad work in general. I was just
> >>>talking on this particular case, when an update breaks a lot of spells.
> >>>And there is indeed a big paradox. For example, we are currently
> >>>discussing a lot on the better way to ensure sources integrity, we have
> >>>a good security team to ensure that our spells are safe, we have great
> >>>tools in sorcery, good spells, but on the contrary, we don't care about
> >>>breaking tons of packages with a simple update, without any notice in
> >>>the spell (even in the HISTORY). Am I the only one to think there is
> >>>something wrong with that ?
> >>>
> >>>I think most people have not enough time to keep an eye on IRC, ML and
> >>>bugzilla as you suggest. And I also believe we lose users when such
> >>>things happen.
> >>>But maybe I do not well understand the purposes of SMGL and the people
> >>>we want to address to...
> >>
> >>Isn't the purpose of the test grimoire to find problems like this so that
> >>people can mention them before they get to stable and we can decide how
> >>best to respond?
> >I expected such an answer. ;-)
> >Yes, it is true that 'test' grimoire is designed, as its name means to
> >test spells. :=)
> >Hopelessly, we know well that a lot of normal users use it [0]. It's
> >true however that they take a risk and they are warned.
> >But in this case, the maintainer knew well that the update broke a lot.
> >He updated it in july in devel, so I think he had enough time to notice
> >that.
> >And even if this grimoire is only designed to developers, I think this
> >would be good to not waste the time they can provide to SMGL.
> 
> This doesn't happen if the recommended method of updating is used:
> `sorcery system-update` (or `sorcery -s` for the lazy ;)). That will
> update Sorcery, the grimoires, clean do some cleaning, update spells,
> and then check integrity (IIRC).

That was our policy about such updates until now, but with a better
trigger system we should probably reconsider that. I haven't had time to
look closely at the new triggers handling, but if I understood it
correctly those triggers would be handled during dependency resolution,
so they'd show up in the list of spells to cast, which would make a
warning unnecessary as all those dependees would then show on a cast of
a new openssl version.

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org