Re: [gentoo-dev] RFC: security updates only? (security-1.0.ebuild)

[Karsten Schulz <kaschu@t800.ping.de>]

Am Samstag, 16. August 2003 21:38 Marius Mauch wrote:
> I don't know how many people actually tested my stuff
> (http://gentoo.devel-net.org/glsa/ in case you haven't seen it) so I'll
> explain how it works:

I did :-)

> So, what is needed to get this working?
> - put the GLSA in a standard location for automated retrieval, I suggest
> both in the rsync tree and somewhere on www.gentoo.org
> - convert all GLSA into XML format, this could be done by the authors or
> a converter script
> - some code additions, nothing major
> - a lot of testing :)

I would like to discuss some aspects of your software. I like it, and I think, 
it could make admin's life easier. 

First, for what reason do you maintain /var/cache/edb/glsa? You could ask 
portage to see, wether a special version of a package is installed in the 
system or is not. To store applied GLSAs in this file seems redundant to me, 
isn't it?

Second, the 'glsa-' prefix of the GLSA filenames seems unnecessary to me. The 
GLSA information is stored in the directory /usr/portage/glsa/. Why not name 
the file with its unique GLSA identifier (200307-07 or perhaps 
200307-07.xml), shouldn't that be enough?

In your 'readme' file you wrote, that there is no installation needed. 
Nevertheless I would provide a little install-script, which checks the 
presence of the needed files and directories (/etc/portage/, 
/usr/portage/glsa/  and /var/cache/edb/glsa). Without this dirs and the file, 
glsa.py fails.

Please feel free to contact me for further testing!

have fun!
Karsten



--
gentoo-dev@gentoo.org mailing list