Re: [gentoo-dev] RFC: security updates only? (security-1.0.ebuild)

[Marius Mauch]

On Sat, 16 Aug 2003 19:11:36 +0200
Paul de Vrieze <pauldv@g.o> wrote:

> On Saturday 16 August 2003 17:59, Karsten Schulz wrote:
> > *After* rsyncing, but *before* building the cache, emerge should
> > create a statical version of
> > app-admin/security/security-VERSION.ebuild with the dependencies
> > corresponding to the current system and the correct version. After
> > creating this ebuild, the cache could be build and an emerge -p
> > security will show the needed updates. That seems to me a few lines
> > of python code and an introduction of the new GLSA file.
> >
> > How is that?
>
> Why not just having a utility (or integrate it into emerge) that scans
> all installed packages, compares them with the list and tries to
> update those that are with an ebuild in the same slot. If there is no
> such ebuild it issues a warning.

I don't know how many people actually tested my stuff
(http://gentoo.devel-net.org/glsa/ in case you haven't seen it) so I'll
explain how it works:

glsa-check is a tool to read a directory (could also be on a remote
server) of GLSA files in XML format and can do the following actions on
it:- print a list of all unchecked GLSAs, using a checkfile that is
updated on other actions
- test if the current system is affected by a GLSA
- print a plaintext version of a GLSA (similar to the current plaintext
format)
- tell the user all necessary steps to apply a GLSA to the system
- apply a GLSA automatically (not implemented yet, I just need to find
the best way to do it) and add it to the checkfile
- "inject" the GLSA into the checkfile in case the testing was wrong or
the user fixed it manually

The glsa-check.py is just a frontend for most parts, the real work is
done in the glsa.py class, integration in portage at a later stage
should be rather easy. I'll check with carpaski once we get to this.

If someone doesn't understand why I chose XML over the current plaintext
format, the reasons are
- it's IMO easier to parse in python, no custom parser needed
- allows some enhancements as specifying multiple affected/fixed
versions or implement multi-language support (not in the current DTD)
- converting to other formats (e.g. html for online viewing) is easy
with XSL

So, what is needed to get this working?
- put the GLSA in a standard location for automated retrieval, I suggest
both in the rsync tree and somewhere on www.gentoo.org
- convert all GLSA into XML format, this could be done by the authors or
a converter script
- some code additions, nothing major
- a lot of testing :)


Ok, so far the information on the current state, I'm open to any
questions/suggestions/comments. The code is only a prototype, easy to
change at the moment. I already discussed this with people on -security
and -server, so far people seem to like this, but I need the views of
some devs now.

Marius

--
gentoo-dev@g.o mailing list