Re: [gentoo-dev] GLEP 19, reloaded (again)

[Spider <spider@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1748 bytes --]

begin  quote
On Tue, 10 Aug 2004 00:01:07 +0000
Kurt Lieber <klieber@gentoo.org> wrote:

> One think that I think *everyone* agrees on is that any stable tree
> needs to be regularly updated with security fixes.  With this in mind,
> I'm concerned with trying to maintain multiple separate SYNC modules. 
> We'd have to upgrade each one with every GLSA, thus doubling or
> tripling the amount of CVS work needed each time.

Once again, coming from an ISV standpoint where we would have loved to
use Gentoo (or, I would, some of the people wouldn't care, and one or
two i'd have to beat to make them bend to my will, but whatever ;) 

We had to scrap both Gentoo -and- Debian stable trees. Why?  Because
both update the -main- repository when releasing security fixes/
bugfixes. Neither have a stable tree thats archived once and never
changes.

If you have to actively change a tree (modifications directly into the
"frozen" tree) which is the case in many environmens, you get stuck with
this problem. if upstream ever changes their tree, work is lost. You can
separate local trees and so on, however, once again work is lost when
internal revisions have superceeded the ones in the tree. (fex, local
changes to sshd to patch ther initscripts and default config files
before rollout, which ups the revision of openssh a few times, and then
there is a backported securityfix?  It won't get merged. )

this is why I'd like to push, once more, for separated "stable" (frozen
snapshot basically) and "updates"  pushed in a separate repo. If we
want others to use this in enterprise, we have to make it easy for them.
  :-)

//Spider



-- 
begin  .signature
Tortured users / Laughing in pain
See Microsoft KB Article Q265230 for more information.
end

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]