1 |
Ian, |
2 |
|
3 |
I was just going on about a similar concern to yours and Chris Schwerdt replied just this |
4 |
morning with this: |
5 |
|
6 |
<snip> |
7 |
Give unclepine a try (unclepine -u). |
8 |
http://forums.gentoo.org/viewtopic.php?t=260866 |
9 |
</snip> |
10 |
|
11 |
I tried it out and it seems to work pretty well. The author claims that equery depends |
12 |
isn't very reliable. I tried unclepine with glib -- which "emerge --depclean" said it |
13 |
wanted to remove, but "equery depends" said is depended on by a bunch of packages -- and |
14 |
it says glib is not depended on by anything. Go figure. |
15 |
|
16 |
I agree that there are definitely some rough spots in portage (though you should switch to |
17 |
FreeBSD and see how much of a mess the Ports system is in comparison). I've been using |
18 |
gentoo for a couple years and I just figured out the stuff about packages not getting |
19 |
updated if it's not in the world file. |
20 |
|
21 |
Oh, by the way emerge -uD world will update dependencies of everything in the world file, |
22 |
even if there not in the world file themselves... it's the stuff that gets emerged and |
23 |
then stops being a dependency of something else that's the problem. Although, I suppose |
24 |
one could make the weak argument that, if a package is no longer a dependency of anything, |
25 |
it's probably not going to be exercised. Still, it seems this would be pretty simple to |
26 |
solve if there were an "emerge *", that checked every package on your machine for an update. |
27 |
|
28 |
b |
29 |
|
30 |
PS: just before I sent this I had a hunch and tried "equery depends glibc"... it has the |
31 |
same output as "equery depends glib". So, that was just a lack of specificity on my |
32 |
part... though equery really should squawk if a pkg is not specific enough (or not found). |
33 |
If I try "equery depends dev-libs/glib" it comes back with no dependencies. |
34 |
|
35 |
|
36 |
|
37 |
|
38 |
Ian P. Christian wrote: |
39 |
> I've recently been spending some time getting to know a little more about |
40 |
> portage, and I've run into a few issues. |
41 |
> |
42 |
> $ emerge --update --deep --newuse world |
43 |
> |
44 |
> It's reasonably well known that the above doesn't update all packages |
45 |
> installed on a system - I think it only updates packages that are in the |
46 |
> world file. Recently, this issue has left a server of mine with a insecure |
47 |
> version of apache (apache was installed due to a dependency caused by PHP, or |
48 |
> some application I installed that pulled in php, which in turn pulled in |
49 |
> apache.). |
50 |
> The man page does cover this, but it's by no means made obvious - and I think |
51 |
> this is rather a large issue, as a log of users of gentoo probably don't know |
52 |
> this. |
53 |
> |
54 |
> From the manual: |
55 |
> |
56 |
> "When you install a package with uninstalled dependencies and do not |
57 |
> explicitly state those dependencies in the list of parameters, they will not |
58 |
> be added to the world file. If you want them to be detected for world |
59 |
> updates, make sure to explicitly list them as parameters to emerge." |
60 |
> |
61 |
> It should have a big WARNING or something next to it IMO. |
62 |
> |
63 |
> emerge --depclean will point out what isn't in your world file for you, so you |
64 |
> can go ahead and add things to the world file manually. Having done this, |
65 |
> when you uninstall whatever it was that dragged that dependency in in the |
66 |
> first place, you will get unneeed packages on the system. |
67 |
> |
68 |
> Lets say for examples sake I install mail-client/squirrelmail. This will pull |
69 |
> in PHP, which will pull in apache. In this case, -uD will not update apache |
70 |
> should a new version appear. An emerge --depclean will show apache as being |
71 |
> removable- so apache will need manually adding to the world file. Now, when |
72 |
> I uninstall squirrrelmail, apache is no longer needed, but depclean won't |
73 |
> show that, because I was forced to add it to the world file. In a lot of |
74 |
> situations, the package might be a lot more obscure, perhaps some odd |
75 |
> libraries which now are in the world file, and will stay there, because |
76 |
> unless I manually look though the world file, and run an 'equery depends' on |
77 |
> each one, I won't notice they are no longer needed. |
78 |
> |
79 |
> So it seems that I either suffer packages not being updated, or am forced into |
80 |
> adding things into the world file and then face the problem that dependencies |
81 |
> will not be removable by depclean. |
82 |
> |
83 |
> Also, I don't understand why emerge --depclean will show a package, which upon |
84 |
> doing an 'equery depends' on that package will show that actaully that |
85 |
> package is needed. Why do these tools contradict each other? Surly depclean |
86 |
> should have the logic that equery uses to see when a dependency really is |
87 |
> needed? |
88 |
> |
89 |
> glsa-check goes some way to solving the problem, it does check to see if there |
90 |
> are outdated packages that have been effected by security issues - but it |
91 |
> doens't update libraries that were installed but aren't in the world file. |
92 |
> |
93 |
> Is there a script that's been developed to be cronned to email the sys admin a |
94 |
> report saying what packages need updating? I noticed that in the last month |
95 |
> on this list there has been some useful information about running glsa-check |
96 |
> and rsynicng just part of the portage tree. This kind of thing is intregal to |
97 |
> running a server, and if no such script exists in the portage tree, I will |
98 |
> attempt to write one. |
99 |
> |
100 |
> Kind Regards, |
101 |
> |
102 |
-- |
103 |
gentoo-server@g.o mailing list |