Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Mar 07, Eric Sandall [eric AT sandall.us] wrote:
> Jeremy,
> While you do have a good point, I still believe my point is valid. While
> we do not hand-hold our users with configurations and setups, we *do*
> lead them to expect spells to cast with the defaults, and for fixes in
> spells to be applied so that future casts work (hence the implementation
> of UPDATED/PATCHLEVEL in Sorcery). I view it as a Bad Thing (TM) for us
> to be telling users to recast a package to obtain a fix as they should
> *never* have to come into IRC, the forums, or our mailing lists asking
> why something doesn't work when we have the fix and failed to have the
> fix applied to their system.

I know you think it's a bad thing, but you aren't really addressing the
points about why the alternative can also be a bad thing.  Both approaches
have issues, the weight of the issues varies depending on the individual
environment.  It's a much bigger problem for me to have to rebuild glibc 3
extra times on every box because a man page moved or something than it is
to have to search bugzilla or ask a question when some side feature doesn't
work on first blush.  Expecting people to hit a knowledge base or bugzilla
when looking for solutions is not at all uncommon, and we expect people to
do that today for any fixes that haven't made it from test to stable yet.

> For people with slow systems (who should already know that they're going
> to be spending a lot of time compiling) and people who check every
> update, we have `sorcery queue-security`. There is no reason not to use
> PATCHLEVEL to force packages to be queued when that'd fix a current or
> future problem.

There are bugfixes that have nothing to do with security that absolutely
need to present themselves as critical updates.  The recent business of
apache2 moving its default files around is a prime example.  Yes, that was
a file move, but it was a file move that broke production systems because
it included things like the existing conf files and document roots being
ignored.

Attachment: pgppypEkY5_7T.pgp
Description: PGP signature