Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Jan 08, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> On Sun, Jan 07, 2007 at 02:24:41PM -0600, Jeremy Blosser wrote:
> > On Jan 07, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> > > First of all, who are these users? We need evidence.
> > 
> > We hear from a decent number of users who do the 6 month / 1 year update
> > thing, though we've never really accepted supporting that timeframe.
> 
> > According to
> > 
> > http://ledger.sourcemage.org/users/statistic_live.php?select=openssh
> > 
> > 6 of 41 machines (14%) are running openssh 4.3p1, which hit the grimoire
> > 2006-02-01 and is older than what's even in the current stable.  This 
> > isn't
> > a lot of data (it would be nice if ledger could show the grimoire those
> > boxes are on; does anyone know a way?) but it's what we probably have
> > available.
> 
> Those were machines that have recently reported their setup, I hope?

Yes, "active" is defined in ledger as people who have reported stats in the
last month.  If you get the full list of every machine in there it's in the
hundreds and lists a lot more versions.

> > While people running stable in production are going to be the most
> > critical cases (as you noted), we hear it from general workstation users 
> > as
> > well.
> 
> Well, one has to ask why. Do they not update because updates tend
> not to work? Because stable releases are infrequent? Or because they
> prefer that way of doing things? Or some combination of factors?

I'm going to say the safe money is on "laziness".  There's nothing out of
the box that sets up an automated update schedule, and most people are
going to tend to not do that themselves unless prompted by a need for some
particular update or a security alert they decide they care about.  The
majority of users don't update for its own sake, at least not consistently.

> > Where do we provide archival versions of stable?  This is definitely a 
> > good
> > way to address this issue, but to my knowledge we don't provide old
> > grimoire tarballs right now.  This is bug #11809; there it's primarily
> > meant to address the "old versions of spells" issue, but we might extend 
> > it
> > for this by making sorcery upgrade grimoire-version-aware warning people
> > trying to skip too many versions that they should do it serially.
> 
> I thought we were doing this, I guess we're not, my mistake. Its easy
> to do, I've done it with sorcery for most of my tenancy as component lead.

We don't, and we should, and I think as long as we start it answers the
rest of the questions here.

> > A very related issue is that we don't currently have a solid definition of
> > how long transitional code should stick around.  It used to be two weeks,
> > which we had to change when we got off the two week cycle, now it's 
> > loosely
> > seen as 2 stable releases.  We need to define that for the benefit of
> > users.  Something like the above recommended upgrade path would make this
> > easier to define.
> 
> I dont have a good answer, and I dont want to pick one now. I'd like us
> to try things out, and work out the finer details later based on what
> we're actually capable of, not some goal we agree would make people
> happy but no one wants to implement.

As long as archives are available and every piece of transitional code
shows up in at least one stable release (and they must), this is a much
less significant issue.

Attachment: pgpOmfO1s7kCV.pgp
Description: PGP signature