Re: [gentoo-user] skype package changes I don't understand

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 05/21/2012 05:10 PM, Volker Armin Hemmann wrote:
> Am Montag, 21. Mai 2012, 08:55:25 schrieb Mark Knecht:
>> On Mon, May 21, 2012 at 8:04 AM, Markos Chandras
>> <hwoarang@g.o>
> wrote:
>>> On Mon, May 21, 2012 at 3:46 PM, Mark Knecht
>>> <markknecht@×××××.com> wrote:
>>>> I love my Gentoo-devs, but what is the train of thought
>>>> here? skype-2.2.0.35-r1 was ~amd64 yesterday. It's installed
>>>> and working fine. Today 2.2.0.35-r99 is ~amd64, which is
>>>> perfectly fine, but they've completely removed -r1 and now
>>>> I'm required to unmask emulation packages that only came out
>>>> today? That doesn't seem quite right...
>>>>
>>>> Why did they completely get rid of -r1? That should stick
>>>> around for a little while after -r99 becomes ~amd64,
>>>> shouldn't it?
>>>>
>>>> - Mark
>>
>> <SNIP>
>>
>>> -r1 had a security problem. You should unmask the emulation
>>> packages and continue the update process. Look at the ChangeLog
>>> so see what changed. Both versions are ~amd64 so I don't
>>> understand your complain about keeping -r1 in the tree for a
>>> while.
>>>
>>> Markos
>>
>> Thanks Markos. That's likely what I'll do, although the
>> alternative I'm looking at for now is possibly getting -r1 from
>> an overlay.
>>
>> I didn't think I was _complaining_. I was just asking what the
>> train of thought was that leads them to do this sort of thing.
>> Everything in the world has a security problem.
>
> well, apart from this being not true at all. It is just stupid to
> keep a known BAD version in a TESTING tree.
>
>> We know they are either found or not found. Unmasking 8 emulation
>> libraries that have _yesterdays_ date in their names, and
>> therefore makes them quite new, may:
>
> new for their compilation. Not the code inside.
>>
>> 1) Create more security problems
>
> may, but it fixes a KNOWN problem.
>
>>
>> 2) Create issues with other programs that use the libraries.
>
> which are.. none?
>
>>
>> Anyway, thanks for the response. I'll either unmask or use an
>> overlay.
>
> if you use testing, you have to deal with such kind of situations.
> Using a known broken version is just stupid. There isn't a choice
> between those two. There is only a choice between: use unstable or
> stable. And if you use unstable, don't complain about things being
> fluid.
>
- From what I can tell, he is not using ~amd64 (testing). He uses a
mixed system (stable with a few packages in package.keywords) which
sometimes is even worse :)

The best way to deal with your problem (and avoid seeing your
package.keywords getting bigger and bigger) is to grab -r1, mark it
stable, put it in your local overlay and keep using that indefinitely.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)

iQIcBAEBCgAGBQJPuneqAAoJEPqDWhW0r/LC538QAJNaPIa0BSCh67//wIXgXYbX
pi231wBAhc0yGxfIcfXiNJBvTD5D08AAFhswoHHMer6/H1+NHKaeF8MnNmpt+41W
FHRj5bG/30uhgD0thb6tmZ78GEWMOkRxPtv0jPQk0Y2YIkI9RYk3eYkgqD2MVbJz
XJfI5HWpOB5Eh3fiNJkzc5mW2bdPLm0dFS5dmkKtVclM7bI4DJ42Gwk9pOgJ+T+H
ciGPQt4NvqqXf94pV5LVXej9+93pTlNA4QvtSE1Io1T2srHrO5/3KE5t1QF6eht1
odSJMID+hZ7ViOIRxK1a453sAzO8rK1SZJhoKzYFhPonQq/VFymU/sGcap2gU3Y1
FQKVeb10nZdAT3v2dw8DaqGnxJHdWcbwRaJOy6M28vdDnOvFBwZYzFn5zTugwHr7
Gcd/buQ6yCtWvUUO/QtgkIgGVewxE5QdQ7Pn3ytt+j3wIQV9QVs46dEUy/rOc5FU
deibghpnTYy1vn3uT5sLsDHlvWtE2XIonowPeBRcQmQJeo9snqIf2WBCn3ExiWym
7Bj0iHVbnEQcdWnIuRiK5sR5eSi+lJv/1Z+xwH98lFXGyX8jM6501W9ZZRBxwMoA
mbCv+RmHfMKUwHhVrdk4qmI/McgDN6DFkS1I/fHaa/mQ0ImDh5U9CahxvvsVz9s+
iV17+9hETK1TAMP9G2yb
=+5ZX
-----END PGP SIGNATURE-----