Re: [gentoo-server] requirements for a more stable portage tree

[Adam Morley]

On Thu, Feb 12, 2004 at 07:51:39PM +1100, Chris wrote:
> If you want to be able to build and maintain a server for a year or two,
> then shouldn't you perhaps built an internal rsync server that doesn't
> update? then you can rebuild whenever you like and it's under your
> control.
>
> I think 2 years is excessive, but I definately think the idea of a
> frozen tree is imperative for a gentoo server.

This is my opinion only, but I'd like longer than a year --- more like 2-3.  We've been on more of a three year cycle for many servers (especially backends), with only security/bug fixes.

That would be 12 releases needing security fixes at any given time, which could (will) become a management headache.

FWIW, many enterprises I know of still have setups running Solaris 2.6 and 7.  Solaris revs last until five years after last ship (LS)  For the first two years after LS, Solaris revs get bug/security/etc. patches, then the last three years just the pre-existing patches are available ([1]).  Of course, with Solaris, we're talking about revs that have been shipping for a few years before LS.

Win98 + Win98SE were supported three years after GA, longer with whatever "Extended Support" is.  Server versions of 2000 get five years of mainstream support starting at GA, and two more on extended. [2]

Granted, both of the above are commercial examples.  But for a long time, enterprises have been running commercial options, so. . .

Perhaps looking at Debian stable (patches for current stable only, others "best effort" IIRC), FreeBSD ("Each branch is supported by the Security Officer for a limited time only, typically through 12 months after the release." [3]), OpenBSD (last two stables, new stable every 6 months = 1 year, IIRC)

This is one realm where commerical support options might have to exist?  Ie: stable:x86 (etc.) exist for a year (four sets at any given time), and then "dies" but someone could come in and offer pay updates for more than a year.

Some might argue about comparing commercial support policies, but we're talking about enterprises here, aren't we?  What do (or have) most enterprises run?  Mainframes, AIX, Solaris, Windows, etc.

1. http://sunsolve.sun.com/pub-cgi/retrieve.pl?display=plain&doc=finfodoc%2F10012
2. http://support.microsoft.com/default.aspx?scid=fh;[ln];LifeWin
3. http://www.freebsd.org/security/index.html#adv

bye,

-- 
adam