Re: [gentoo-server] A few questions about portage

[Matthew Lange]

I have the following as an emerge.sh script in my croon.daily directory.
 I used to have a lock file to prevent multiple copies from running, but
I now use fcron, which has this feature built-in.  By default, all
output gets mailed to root, which I have aliased to me.

---snip---
    emerge sync  2>&1 > /dev/null
        echo 'emerge system:'
        emerge -pv --nocolor system
        echo 'emerge world:'
        emerge -pv --nocolor world
        /usr/bin/revdep-rebuild --pretend --quiet --nocolor
---snip---

Unfortunately, ANSI color is hard-coded into the utilities, so I get a
few control-characters in the output...but it works OK.

I have a better one I wrote, but I'll need to find it...I'll post it later.

Matt



Ian P. Christian wrote:
> I've recently been spending some time getting to know a little more about
> portage, and I've run into a few issues.
>
> $ emerge --update --deep --newuse world
>
> It's reasonably well known that the above doesn't update all packages
> installed on a system - I think it only updates packages that are in the
> world file.  Recently, this issue has left a server of mine with a insecure
> version of apache (apache was installed due to a dependency caused by PHP, or
> some application I installed that pulled in php, which in turn pulled in
> apache.).
> The man page does cover this, but it's by no means made obvious - and I think
> this is rather a large issue, as a log of users of gentoo probably don't know
> this.
>
> From the manual:
>
>        "When you install a package with uninstalled dependencies and do not
> explicitly state those dependencies in the list of parameters, they will not
> be added to the world file.  If you want them to be detected for world
> updates, make sure to explicitly list them as parameters to emerge."
>
> It should have a big WARNING or something next to it IMO.
>
> emerge --depclean will point out what isn't in your world file for you, so you
> can go ahead and add things to the world file manually.  Having done this,
> when you uninstall whatever it was that dragged that dependency in in the
> first place, you will get unneeed packages on the system.
>
> Lets say for examples sake I install mail-client/squirrelmail.  This will pull
> in PHP, which will pull in apache.  In this case, -uD will not update apache
> should a new version appear.  An emerge --depclean will show apache as being
> removable- so apache will need manually adding to the world file.  Now, when
> I uninstall squirrrelmail, apache is no longer needed, but depclean won't
> show that, because I was forced to add it to the world file.  In a lot of
> situations, the package might be a lot more obscure, perhaps some odd
> libraries which now are in the world file, and will stay there, because
> unless I manually look though the world file, and run an 'equery depends' on
> each one, I won't notice they are no longer needed.
>
> So it seems that I either suffer packages not being updated, or am forced into
> adding things into the world file and then face the problem that dependencies
> will not be removable by depclean.
>
> Also, I don't understand why emerge --depclean will show a package, which upon
> doing an 'equery depends' on that package will show that actaully that
> package is needed. Why do these tools contradict each other? Surly depclean
> should have the logic that equery uses to see when a dependency really is
> needed?
>
> glsa-check goes some way to solving the problem, it does check to see if there
> are outdated packages that have been effected by security issues - but it
> doens't update libraries that were installed but aren't in the world file.
>
> Is there a script that's been developed to be cronned to email the sys admin a
> report saying what packages need updating? I noticed that in the last month
> on this list there has been some useful information about running glsa-check
> and rsynicng just part of the portage tree. This kind of thing is intregal to
> running a server, and if no such script exists in the portage tree, I will
> attempt to write one.
>
> Kind Regards,
>
-- 
gentoo-server@g.o mailing list