Re: [gentoo-user] Re: Heads up: Your system might be broken and/or insecure due to serious patch-2.6 bug

[Alan McKinnon]

On Wednesday 02 December 2009 16:48:16 Philip Webb wrote:
> 091202 Nikos Chantziaras wrote:
> > On 12/02/2009 12:51 PM, Alan McKinnon wrote:
> >> On Tuesday 01 December 2009 18:02:48 Nikos Chantziaras wrote:
> >>> Everyone should read the following and follow the advice given:
> >>> http://blog.flameeyes.eu/2009/12/01/gentoo-service-announcement-keep-cl
> >>>ear-of-gnu-patch-2-6
> >>
> >> I emerged patch-2.60 when it hit ~amd64 then downgraded it 10 days later
> >> when a report on b.g.o. showed it was affecting OOo.
> >> Right in the middle of those 10 days, I ran 'emerge -e world'
> >> </sigh>
> >
> > Yep, this bug was a major annoyance for me too.
> > I emerged patch-2.6 on November 15
> > and since then, being on ~amd64, a *lot* of other packages.
> > After downgrading, I needed to rebuild about 300 packages,
> > including all of KDE4, Qt, Firefox and OpenOffice.
> > Quite amazing how much damage a bug in a small package like this can have
> > on a source-based distro...
>
>  2  pieces of advice to avoid such problems:
> (1) never use the 'testing' versions of system pkgs;
> (2) never run 'emerge world' without the '-p' flag.


Balls.

Neither of those will fix anything and they are not even feasible for this.

I run ~amd64 for a reason, I want it that way. There is no known way to run 
amd64 for @system and ~amd64 for @world and still retain one's sanity.

Of course I ran emerge -p. Well actually I run emerge -a but the effect is the 
same - see what's going to be installed before it's installed. Until a week 
ago no-one knew the effects patch-2.6.0 would have so when it appears in the 
list there's no reason to not proceed.

Running amd64 isn't an option for me - this isn't one of my critical servers, 
it's my bleeding edge notebook and I like it the way it is. If I wanted to 
avoid problems like this I'd be using Ubuntu LTS instead.

I'm not whinging about patch. I run ~amd64 precisely to help detect such 
things. I'm miffed at my own bad luck - the first emerge -e world I've had to 
do in two years and I just happen to have done it in the two week window about 
this package. Most folk now have to rebuild 70 - 300 packages, I'm stuck with 
potentially 1472 <sigh>


-- 
alan dot mckinnon at gmail dot com