Re: [gentoo-dev] News item for restructuring of hardened profiles.

[Anthony G. Basile]

On 11/10/2010 05:44 PM, Anthony G. Basile wrote:
> On 11/10/2010 04:42 PM, Matthew Summers wrote:
>> On Wed, Nov 10, 2010 at 3:39 PM, Matthew Summers
>> <quantumsummers@g.o>wrote:
>>
>>> On Wed, Nov 10, 2010 at 3:22 PM, Anthony G. Basile
> <blueness@g.o>wrote:
>>>> On 11/10/2010 10:29 AM, Petteri Räty wrote:
>>>>> On 11/10/2010 02:42 PM, Peter Volkov wrote:
>>>>>> В Втр, 09/11/2010 в 18:20 -0500, Anthony G. Basile пишет:
>>>>>>> Title: Restructuring of Hardened profiles
>>>>>> [...]
>>>>>>> Display-If-Profile: hardened/linux
>>>>>> Is it possible to restrict this news item to be shown on affected
>>>>>> profiles only?
>>>>>>
>>>>> Yeah it shouldn't show up in new installs that are already using the
>>>>> migrated profiles.
>>>>>
>>>>> Regards,
>>>>> Petteri
>>>>>
>>>> I'm not sure how to address this concern. I reread GLEP-42 and all I
>>>> see is
>>>>
>>>> Display-If-Installed: eg. net-www/apache
>>>> Display-If-Keyword: eg. amd64
>>>> Display-If-Profile: eg linux/hardened
>>>>
>>>> If someone knows how, I'll be happy to address this concern.
>>>>
>>>>
>>>> --
>>>> Anthony G. Basile, Ph.D.
>>>> Gentoo Developer
>>>>
>>>>
>>> I suspect it should be the following.
>>>
>>> Display-If-Profile: hardened/linux/amd64/10.0
>>> Display-If-Profile: hardened/linux/amd64/10.0/no-multilib
>>> .
>>> .
>>> .
>>> etc.
>>>
>>> Now, I have no clear indication that "Display-If-Profile" can be used more
>>> than once or if it accepts an expression that would allow us to catch both
>>> the multilib and no-multilib examples, as well as the x86 profile, etc.
>>>
>>> Cheers,
>>> --
>>> Matthew W. Summers
>>>
>>>
>> So, I re-read GLEP 42 and this snippet makes it clear that we will need one
>> "Display-If-Profile" header element for each profile we are migrating.
>>
>>
>> The algorithm used to determine whether a news item is 'relevant' is as
>> follows:
>>
>> For each Display-If- header type which occurs at least once:
>>
>> The news item is not relevant if none of the headers of this type are
>> successfully matched.
>>
>> Otherwise the news item is relevant.
>>
>>
>> Regards
> The list of effected profiles is fairly long ->
>
> cd /usr/portage/profiles/hardened/linux/ && find . -type d | grep 10.0
>
> ./ia64/10.0
> ./ia64/10.0/server
> ./ia64/10.0/desktop
> ./ia64/10.0/developer
> ./x86/10.0
> ./x86/10.0/server
> ./x86/10.0/no-nptl
> ./x86/10.0/desktop
> ./x86/10.0/developer
> ./amd64/10.0
> ./amd64/10.0/server
> ./amd64/10.0/desktop
> ./amd64/10.0/no-multilib
> ./amd64/10.0/developer
> ./powerpc/ppc32/10.0
> ./powerpc/ppc32/10.0/server
> ./powerpc/ppc32/10.0/desktop
> ./powerpc/ppc32/10.0/developer
> ./powerpc/ppc64/10.0
> ./powerpc/ppc64/10.0/server
> ./powerpc/ppc64/10.0/desktop
> ./powerpc/ppc64/10.0/32bit-userland
> ./powerpc/ppc64/10.0/32bit-userland/server
> ./powerpc/ppc64/10.0/32bit-userland/desktop
> ./powerpc/ppc64/10.0/32bit-userland/developer
> ./powerpc/ppc64/10.0/64bit-userland
> ./powerpc/ppc64/10.0/64bit-userland/server
> ./powerpc/ppc64/10.0/64bit-userland/desktop
> ./powerpc/ppc64/10.0/64bit-userland/developer
> ./powerpc/ppc64/10.0/developer
>
>
> If this can be reduced by removing the subprofiles then it reduces to
>
> ./ia64/10.0
> ./x86/10.0
> ./amd64/10.0
> ./powerpc/ppc32/10.0
> ./powerpc/ppc64/10.0
>
>
> If someone can assure me it will work, change my current
> Display-If-Profile to
>
> Display-If-Profile: hardened/linux/ia64/10.0
> Display-If-Profile: hardened/linux/x86/10.0
> Display-If-Profile: hardened/linux/amd64/10.0
> Display-If-Profile: hardened/linux/powerpc/ppc32/10.0
> Display-If-Profile: hardened/linux/powerpc/ppc64/10.0
>
>
Okay, after speaking to ssuominen who had a similar situation, you have
to spell out the entire profile.  So here is  the latest version of the
news item.  There are lots of  Display-If-Profile lines, but it should
do the trick.


-- 
Anthony G. Basile, Ph.D.
Gentoo Developer