Re: [gentoo-dev] security updates only?

[Marius Mauch <genone@genone.de>]

On 13 Aug 2003 07:59:23 +0200
Klavs Klavsen <kl@vsen.dk> wrote:

> Hi guys,
> 
> I know there has been several requests (also from me) asking for a way
> to do security updates only.
> 
> Something like emerge -s world --nodeps (should update every package
> that has had a GLSA for it if the version matches the GLSA(s)) would
> IMHO be very cool and very much needed. Then I bet many people would
> set that to update automagically - which should be possible - would
> help security a whole lot :)
> 
> I'm no python programmer (atleast not yet - a frind of mine tells me
> it's quite easy, and a cool language :) - and I don't know how well
> portage is structured, but I think this security thing could easily be
> accomplished, if the GLSA's were added to the tree (why shouldn't they
> - they don't take up much space, and why should people have to go to
> the webpage, or receive an email to get notified?).
> 
> What do you think?

I wrote a small prototype for that, but it needs support from the
GLSA guys as it is very difficult to get the GLSA from a script as they
are only published at different mailing lists and the forums. Another
issue is that my script works with XML versions of GLSA, so someone
needs to convert the plaintext versions.
Code, DTD and sample XML GLSA are available at
http://gentoo.devel-net.org/glsa/ .

Marius

--
gentoo-dev@gentoo.org mailing list