Re: [gentoo-security] Idea for easily checking for security updates.

[Enrique Perez]

I think every new *.ebuild could say which -if any- is the
highest version of which it is a security update. if you
sync and you have a lower version, emerge -u security
will execute the new ebuild. This, however, should
respect major versions; it shouldn't unexpectedly install
apache2. At the end of the cycle of every major version
there should be a final ebuild informing the sysadmin
that the gravy train has come to a stop.
That might lead to "special gentoo systems", combinations
of packages of certain versions that are known to work
well for special tasks, which you only have to update
for security. He who writes a howto takes a snapshot
of his system, marks out a few packages, weeds out
whatever is not a dependency of those, and offers it
with the assurance that the configuration he describes
is exact for the system.

--
gentoo-security@g.o mailing list