Re: [gentoo-hardened] Tips for upgrading to the current stable gentoo hardened?

[Anthony G. Basile]

On 06/29/2011 04:39 AM, Kārlis Repsons wrote:
> On 20 June 2011 14:20, Ed W <lists@××××××××××.com> wrote:
>> On 15/06/2011 11:55, Kārlis Repsons wrote:
>>> Hi all,
>>>
>>> I've got a machine, which hasn't been upgraded for some 2 years or less. It
>>> has GCC-4.3.4 and now I tried to upgrade to 4.5.2, but something failed. So
>>> I'm here to ask for the right sequence of upgrades and other actions before
>>> it's too late...
>>>
>>> These actions done already:
>>> 1. updated binutils,
>>> 2. updated glibc,
>>> 3. unmerged and re-emerged libtool (had a blocker),
>>> 4. tried with the new GCC, but failed with some unclear problems,
>>> 5. switched to vanilla GCC and now compile glibc...
>>>
>>> So have I done something bad or what should I do to be sure that the upgrade
>>> goes as smooth as possible? Thanks...
>>
>> You didn't give any info on the problems you had using gcc 4.5 so very
>> hard to comment.  However, roughly the upgrade of any gcc is as per the
>> docs (upgrade, switch to it, upgrade libtool, emerge -ev system)
>>
>> Likely problems you had were dependencies upgrading from a very old
>> system?  Remember there is no harm in masking your gcc, upgrading, then
>> upgrading gcc is this solves some dependency? (Slower)
>>
>> Remember to backup the machine...
>
> Thanks, the problem was rather silly: I ran out of RAM in a diskless machine...
>
> By the way, if I wish to update and totally rebuild my system, what
> steps do I have to take? I've seen many guides telling about the
> toolchain and emerge -e system, then world, but I lack consistency and
> understanding about how exactly and why. Anyone to suggest me some
> valuable link about that?

The safest approach in either switching or recompiling everything is:

1. Make the profile is set "eselect profile list" and pick your hardened
box.  Careful on amd64 about changing multilib/nomultilib.  Stick with
your mutilib-edness (if such a word exists :)

2. Rebuild the tool chain: emerge binutils glibc gcc

3. Rebuild system: emerge --keep-going -eq system
(note anything that fails you might want to file a bug)

4. Rebuild world: emerge --keep-going -eq world
(again not any failures, shouldn't happen else we're not doing our job)

system vs world = system is just the bare minimum packages that any box
running that profile needs.  world = system + what you've added.  You
can skip step 3, but there might be a chance of mixing
unhardened/hardened stuff if you do, but I'm not 100% sure.


-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@g.o
GnuPG FP  : 8040 5A4D 8709 21B1 1A88  33CE 979C AF40 D045 5535
GnuPG ID  : D0455535