Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Sun, Jan 07, 2007 at 05:58:01PM +0500, Alexander Tsamutali wrote:
> 2007/1/7, "Andraž 'ruskie' Levstik" <ruskie AT mages.ath.cx>:
> > Who said they need to upgrade? We provide a mechanism to ONLY update for
> > security fixes so there really isn't much to this. If they wish it so they
> > can also update the rest but it can be limited to security only.
> 
> To get latest security fixes they should install latest stable
> grimoire. So if i use stable-0.5 and have some security issues i
> should install stable-0.6 and use sorcery queue-security. It means
> that we don't provide support for stable releases. This makes our
> process even worse than gentoo's (they use masking to mark stable
> versions).
> 

How about providing a compromise instead of saying it work at all, and
saying its worse then gentoo (Im guessing you're implying that we should
be better than gentoo?). Lets have a real discussion, not immediatly
revert to throwing wrenches in the gears when something doesnt solve
your problems. This isn't rocket science, there are technical problems
and there are resource problems. We have to find technical solutions
within our resource limitations.

One idea would be to support limited updates for several stable releases
back.  Intra-stable releases tend not to be supported for larger issues,
like updating between several versions of ncurses or glibc, or if some
sweeping one-time system-wide change is required. Things are done this
way because we have limited resources, not because of predominantly
technical problems.

If the situation you outlinedabove is truly a problem, then a compromise
would be that security updates will work, provided that some number of
releases havent gone by, or provided there hasn't been a substantial
upgrade relavent to the software in question. Lets say for example openssh
has a security bug, but the latest openssh in current-stable only works
with openssl from current-stable, not previous-stable. In that case
there is a dependent update, and a simple queue-security wouldnt work.
However, sorcery 1.14 provides a lazy update feature, where it asks
about dependent updates. Which, again, in limited contexts work.

I will contend that typically when one cannot upgrade but once every
6 months to a year is doing so because they're running in a production
environment. In that case they're most likely a professional or at least
somewhat educated sys-admin, and they're smart enough to figure out a
process that works for them. Perhaps using some combination of scribbler
and scribe, and possibly lazy updates. The tools are certainly there,
we just dont make that grimoire.

Perhaps if this is important to you, you could make your own custom
grimoire branch tailored to this usage pattern? If its that important
to you.

-Andrew

-- 
_________________________________________________________________________
| Andrew D. Stitt  | acedit at armory.com    | astitt at sourcemage.org | 
| irc: afrayedknot | Sorcery Team Lead       |      ftp://t.armory.com/ |
| 1024D/D39B096C   | 76E4 728A 04EE 62B2 A09A 96D7 4D9E 239B D39B 096C  |
-------------------------------------------------------------------------