[gentoo-user] How to "freeze" my Gentoo system

[gentoo-user] How to "freeze" my Gentoo system

[Michael Higgins]

Don't know the proper term, but I want to stop version updates for a while, yet allow package-rN updates...

I spent most of the last couple of days killing two bugs that were a serious drag on my laptop, involving kacpid hogging the CPU on a resume, or bay swap, and gnome panel freezing on > 7 open windows (a real deal killer). I'd like to spend a few months just using it now that it all works...

So with the latest kernel in the tree unmasked (kacpid bug fix) and a couple of patches and ebuilds in my overlay for a pair of unmasked x11 and gnome packages, what is the method to keep this 'world' in a 'set' and 'forgotten' state? '-)

Cheers,

-- 
 |\  /|        |   |          ~ ~  
 | \/ |        |---|          `|` ?
 |    |ichael  |   |iggins    \^ /
 michael.higgins[at]evolone[dot]org

Re: [gentoo-user] How to "freeze" my Gentoo system

[Alan McKinnon]

On Wednesday 11 March 2009 22:40:54 Michael Higgins wrote:
> Don't know the proper term, but I want to stop version updates for a while,
> yet allow package-rN updates...

This doesn't seem to be a built-in feature of portage after a quick scan of 
the man pages. But I can think of a method to do it the long way round:

The atom syntax you want is <package>~ which means any -rN version (including 
-r0) of the base version.

You could grab a complete list of your system and world (emerge -et), mangle 
it into shape with grep, sed and awk and redirect the whole lot to a 
package.mask file in a format something like this:

>app-1.1.0~


>
> I spent most of the last couple of days killing two bugs that were a
> serious drag on my laptop, involving kacpid hogging the CPU on a resume, or
> bay swap, and gnome panel freezing on > 7 open windows (a real deal
> killer). I'd like to spend a few months just using it now that it all
> works...
>
> So with the latest kernel in the tree unmasked (kacpid bug fix) and a
> couple of patches and ebuilds in my overlay for a pair of unmasked x11 and
> gnome packages, what is the method to keep this 'world' in a 'set' and
> 'forgotten' state? '-)
>
> Cheers,

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] How to "freeze" my Gentoo system

[Dale]

Alan McKinnon wrote:
> On Wednesday 11 March 2009 22:40:54 Michael Higgins wrote:
>   
>> Don't know the proper term, but I want to stop version updates for a while,
>> yet allow package-rN updates...
>>     
>
> This doesn't seem to be a built-in feature of portage after a quick scan of 
> the man pages. But I can think of a method to do it the long way round:
>
> The atom syntax you want is <package>~ which means any -rN version (including 
> -r0) of the base version.
>
> You could grab a complete list of your system and world (emerge -et), mangle 
> it into shape with grep, sed and awk and redirect the whole lot to a 
> package.mask file in a format something like this:
>
>   
>> app-1.1.0~
>>     
>
>
>   
>> I spent most of the last couple of days killing two bugs that were a
>> serious drag on my laptop, involving kacpid hogging the CPU on a resume, or
>> bay swap, and gnome panel freezing on > 7 open windows (a real deal
>> killer). I'd like to spend a few months just using it now that it all
>> works...
>>
>> So with the latest kernel in the tree unmasked (kacpid bug fix) and a
>> couple of patches and ebuilds in my overlay for a pair of unmasked x11 and
>> gnome packages, what is the method to keep this 'world' in a 'set' and
>> 'forgotten' state? '-)
>>
>> Cheers,
>>     
>
>   


Could he just not sync and call it a day?  I suspect this is going to
bite him one day tho.  We know Gentoo likes to be updated fairly
regular.  I been around Gentoo for years and I don't think I would want
to do this.  I'm not sure how much experience the OP has tho.

I do understand that getting something stable and working then wanting
to keep it that way.  I'm just wondering what his mileage may be in the
long run.

Dale

:-)  :-)

Re: [gentoo-user] How to "freeze" my Gentoo system

[Alan McKinnon]

On Thursday 12 March 2009 10:07:03 Dale wrote:

> Could he just not sync and call it a day?  I suspect this is going to
> bite him one day tho.  We know Gentoo likes to be updated fairly
> regular.  I been around Gentoo for years and I don't think I would want
> to do this.  I'm not sure how much experience the OP has tho.

Michael's been around a while, his name is familiar. He did say he wants -rN 
updates so I take that to mean he wants bug fixes and security updates but 
everything else to stay that same and especially no potential ABI/API changes

Not an unreasonable thing actually - it's what you get with RedHat or any 
decent enterprise distro

> I do understand that getting something stable and working then wanting
> to keep it that way.  I'm just wondering what his mileage may be in the
> long run.

I can only imagine what will happen if he forgets that package.mask and then 
removes it six months later:-)

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] How to "freeze" my Gentoo system

[Dale]

Alan McKinnon wrote:
> On Thursday 12 March 2009 10:07:03 Dale wrote:
>
>   
>> Could he just not sync and call it a day?  I suspect this is going to
>> bite him one day tho.  We know Gentoo likes to be updated fairly
>> regular.  I been around Gentoo for years and I don't think I would want
>> to do this.  I'm not sure how much experience the OP has tho.
>>     
>
> Michael's been around a while, his name is familiar. He did say he wants -rN 
> updates so I take that to mean he wants bug fixes and security updates but 
> everything else to stay that same and especially no potential ABI/API changes
>
> Not an unreasonable thing actually - it's what you get with RedHat or any 
> decent enterprise distro
>
>   
>> I do understand that getting something stable and working then wanting
>> to keep it that way.  I'm just wondering what his mileage may be in the
>> long run.
>>     
>
> I can only imagine what will happen if he forgets that package.mask and then 
> removes it six months later:-)
>
>   

Since he has been around a while and knows what he wants, then I guess
he knows the possible pitfalls too.  I just wanted to mention it in case
he doesn't know that not updating can lead to issues later on.  Didn't I
post on a thread recently about a system not being updated in a long
while and a reinstall was better than updating?  It's one of those
things that worries me.

I must confess that I do the same with my kernel.  When I get one that
works, I just don't want to update.  I download them and build a new one
but just don't boot them.  Of course this is another reason why too:

root@smoker / # uptime
 03:23:09 up 60 days, 11:10,  3 users,  load average: 1.16, 1.33, 1.37
root@smoker / #

I go for a while without rebooting and forget the new kernel is there.

Yea, if something happens to the package.mask file, he's in for a
surprise for sure.

OP, you may also want to make package.mask a directory and then you can
sort out your files easier too.  Just something to think about.  I think
that is a new feature.

Dale

:-)  :-)

Re: [gentoo-user] How to "freeze" my Gentoo system

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 671 bytes --]

On Thu, 12 Mar 2009 09:56:47 +0200, Alan McKinnon wrote:

> The atom syntax you want is <package>~ which means any -rN version
> (including -r0) of the base version.

I've only even seen the ~ used at the start of an atom, I didn't know it
could be used at the end too.

> You could grab a complete list of your system and world (emerge -et),
> mangle it into shape with grep, sed and awk and redirect the whole lot
> to a package.mask file in a format something like this:
> 
> >app-1.1.0~  

emerge portage-utils
qatom $(qlist -ICv) | awk '{print ">"$1"/"$2"-"$3"~"}'


-- 
Neil Bothwick

I was married by a judge. I should have asked for a jury.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 892 bytes --]

On Thu, 12 Mar 2009 10:13:30 +0200, Alan McKinnon wrote:

> > Could he just not sync and call it a day?  I suspect this is going to
> > bite him one day tho.  We know Gentoo likes to be updated fairly
> > regular.  I been around Gentoo for years and I don't think I would
> > want to do this.  I'm not sure how much experience the OP has tho.  
> 
> Michael's been around a while, his name is familiar. He did say he
> wants -rN updates so I take that to mean he wants bug fixes and
> security updates but everything else to stay that same and especially
> no potential ABI/API changes

One potential problem is ebuilds disappearing from the portage tree as
packages are updated, so it would be worth copying everything he uses (or
the whole tree) into an overlay.


-- 
Neil Bothwick

It may be that your sole purpose in life is simply to serve as a warning
to others.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Alan McKinnon]

On Thursday 12 March 2009 11:48:48 Neil Bothwick wrote:
> On Thu, 12 Mar 2009 09:56:47 +0200, Alan McKinnon wrote:
> > The atom syntax you want is <package>~ which means any -rN version
> > (including -r0) of the base version.
>
> I've only even seen the ~ used at the start of an atom, I didn't know it
> could be used at the end too.

<sigh> and we both know what "assume" stands for, right?

You must be English. Only an Englishman could point out a blunder like that in 
such a subtle way as to make the other guy cringe with embarrassment...

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] How to "freeze" my Gentoo system

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

On Thu, 12 Mar 2009 12:52:16 +0200, Alan McKinnon wrote:

> > I've only even seen the ~ used at the start of an atom, I didn't know
> > it could be used at the end too.  

> You must be English. Only an Englishman could point out a blunder like
> that in such a subtle way as to make the other guy cringe with
> embarrassment...

LOL! Actually, I checked the portage man page and when I saw no reference
to it there, I assumed it was a new feature you had discovered that
hadn't made it to the man page. It didn't occur to me that when putting
the tilde at the wrong end, you were talking out of the wrong end :)


-- 
Neil Bothwick

LISP: To call a spade a thpade.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Alan McKinnon]

On Thursday 12 March 2009 21:43:32 Neil Bothwick wrote:
> It didn't occur to me that when putting
> the tilde at the wrong end, you were talking out of the wrong end :)

I seem to be doing that a lot lately. You should have seen Tuesdays' blunder:

mysql> UPDATE passwds set passwd=<a_hash>, status="NEW", updated="1236889084";
Rows matched: 4329  Changed: 4329  Warnings: 0

Hang on, that doesn't look right. <sigh> there's no WHERE....
I hope there's a backup...
What's in crontab -l?


Lucky for me, some OTHER bright spark had mysqldump in a daily cron!

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] How to "freeze" my Gentoo system

[Michael Higgins]

On Thu, 12 Mar 2009 09:51:05 +0000
Neil Bothwick <neil@digimed.co.uk> wrote:

> On Thu, 12 Mar 2009 10:13:30 +0200, Alan McKinnon wrote:
> 
> > > Could he just not sync and call it a day?  I suspect this is
> > > going to bite him one day tho.  We know Gentoo likes to be
> > > updated fairly regular.  I been around Gentoo for years and I
> > > don't think I would want to do this.  I'm not sure how much
> > > experience the OP has tho.  

No worries. If I break it, I get to keep the pieces...

> > Michael's been around a while, his name is familiar. He did say he
> > wants -rN updates so I take that to mean he wants bug fixes and
> > security updates but everything else to stay that same and
> > especially no potential ABI/API changes
> 
> One potential problem is ebuilds disappearing from the portage tree as
> packages are updated, so it would be worth copying everything he uses
> (or the whole tree) into an overlay.
> 

Thanks to you both for all the suggestions and caveats... I'll report back when I've done the script to populate package.mask with atoms *pre-*pended by '~'.

As one of you mentioned, it's not an unreasonable thing to want to "freeze" a system, but OTOH Gentoo does like regular updating.

If something drops from the tree, that's okay... My goal is, for packages I've unmasked for the architecture, that they don't keep being updated to the latest available, but eventually come into concordance with 'stable'.

Cheers,

-- 
 |\  /|        |   |          ~ ~  
 | \/ |        |---|          `|` ?
 |    |ichael  |   |iggins    \^ /
 michael.higgins[at]evolone[dot]org

Re: [gentoo-user] How to "freeze" my Gentoo system

[Dale]

Michael Higgins wrote:
> On Thu, 12 Mar 2009 09:51:05 +0000
> Neil Bothwick <neil@digimed.co.uk> wrote:
>
>   
>> On Thu, 12 Mar 2009 10:13:30 +0200, Alan McKinnon wrote:
>>
>>     
>>>> Could he just not sync and call it a day?  I suspect this is
>>>> going to bite him one day tho.  We know Gentoo likes to be
>>>> updated fairly regular.  I been around Gentoo for years and I
>>>> don't think I would want to do this.  I'm not sure how much
>>>> experience the OP has tho.  
>>>>         
>
> No worries. If I break it, I get to keep the pieces...
>
>   
>>> Michael's been around a while, his name is familiar. He did say he
>>> wants -rN updates so I take that to mean he wants bug fixes and
>>> security updates but everything else to stay that same and
>>> especially no potential ABI/API changes
>>>       
>> One potential problem is ebuilds disappearing from the portage tree as
>> packages are updated, so it would be worth copying everything he uses
>> (or the whole tree) into an overlay.
>>
>>     
>
> Thanks to you both for all the suggestions and caveats... I'll report back when I've done the script to populate package.mask with atoms *pre-*pended by '~'.
>
> As one of you mentioned, it's not an unreasonable thing to want to "freeze" a system, but OTOH Gentoo does like regular updating.
>
> If something drops from the tree, that's okay... My goal is, for packages I've unmasked for the architecture, that they don't keep being updated to the latest available, but eventually come into concordance with 'stable'.
>
> Cheers,
>
>   

Something like this was actually discussed a while back for people with
servers that have to be seriously stable.  I don't think anything ever
came out of it but you may want to check around and see if it did and we
missed it.  I would think Alan would know if it did tho since I think he
maintains a few servers.  Few may be understating it a bit.  ;-) 

I think this could be a good idea for some myself. 

Dale

:-)  :-) 

Re: [gentoo-user] How to "freeze" my Gentoo system

[Sean]

On Wed, 2009-03-11 at 13:40 -0700, Michael Higgins wrote:
> Don't know the proper term, but I want to stop version updates for a while, yet allow package-rN updates...

I don't think there's a real good way to accomplish this, but the
approach I would take is to setup a local portage tree that the system
syncs from. You could then cherry pick the ebuild updates that go into
that local, and now customized, portage tree. 

-Sean

Re: [gentoo-user] How to "freeze" my Gentoo system

[Beau Henderson]

On Sat, Mar 14, 2009 at 9:55 AM, Sean <sean@ttys0.net> wrote:
>
> On Wed, 2009-03-11 at 13:40 -0700, Michael Higgins wrote:
>> Don't know the proper term, but I want to stop version updates for a while, yet allow package-rN updates...
>
> I don't think there's a real good way to accomplish this, but the
> approach I would take is to setup a local portage tree that the system
> syncs from. You could then cherry pick the ebuild updates that go into
> that local, and now customized, portage tree.
>
> -Sean
>
>

I'm not sure if this is any use to you, but what I tend to do with my
workstation and laptop which I use daily for work is, I have the
following bash aliases in place ( because I'm lazy ). I tend not to
run a a full deep update via emerge during the work week but do look
out for reported security vulnerabilities via the glsa-check
application. I can then update only the affected package or packages
as needed and the system remains otherwise in-tact and stable.

alias secchk='glsa-check -p affected'
alias secup='glsa-check -f affected'



-- 
Beau Dylan Henderson

"No human being should be denied the fundamental right to educate
themselves or indulge their curiosities. To deny any person the right
to do so, for whatever reason, is nothing more than the safeguarding
of ignorance to ensure that enlightenment does not become a threat.
For nothing in this world is more dangerous than an open mind." --
Matthew Good

Re: [gentoo-user] How to "freeze" my Gentoo system

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 630 bytes --]

On Fri, 13 Mar 2009 19:55:32 -0400, Sean wrote:

> I don't think there's a real good way to accomplish this, but the
> approach I would take is to setup a local portage tree that the system
> syncs from. You could then cherry pick the ebuild updates that go into
> that local, and now customized, portage tree. 

There was some discussion on the dev list a while ago abut providing
alternate portage trees that were not updated except for security and bug
fixes. It would have provided just what you want, but I don't think
anything came of it.


-- 
Neil Bothwick

Windows isn't a virus -- viruses do something!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Sebastian Günther]

[-- Attachment #1: Type: text/plain, Size: 1141 bytes --]

* Neil Bothwick (neil@digimed.co.uk) [12.03.09 10:49]:
> On Thu, 12 Mar 2009 09:56:47 +0200, Alan McKinnon wrote:
> 
> > The atom syntax you want is <package>~ which means any -rN version
> > (including -r0) of the base version.
> 
> I've only even seen the ~ used at the start of an atom, I didn't know it
> could be used at the end too.
> 
> > You could grab a complete list of your system and world (emerge -et),
> > mangle it into shape with grep, sed and awk and redirect the whole lot
> > to a package.mask file in a format something like this:
> > 
> > >app-1.1.0~  
> 
> emerge portage-utils
> qatom $(qlist -ICv) | awk '{print ">"$1"/"$2"-"$3"~"}'
> 

I was playing with this, since I'm thinking about gradually reverting my 
system to stable.

What i was wondering: Is there a reason why you split the qlist output 
into atoms, just to put it together the same way qlist has spitted it 
out?

qlist -ICv | awk '{print ">~"$1}'
should do the job or am I mistaken?

Sebastian

-- 
 " Religion ist das Opium des Volkes. "      Karl Marx

 SEB@STI@N GÜNTHER         mailto:samson@guenther-roetgen.de

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 843 bytes --]

On Tue, 17 Mar 2009 08:46:57 +0100, Sebastian Günther wrote:

> > qatom $(qlist -ICv) | awk '{print ">"$1"/"$2"-"$3"~"}'

> What i was wondering: Is there a reason why you split the qlist output 
> into atoms, just to put it together the same way qlist has spitted it 
> out?
> 
> qlist -ICv | awk '{print ">~"$1}'
> should do the job or am I mistaken?

Yes :)

The awk line only takes the first three items from the qlist
output, category, name and version. You don't want revision numbers in
the list if you are using ~.

~foo/bar-1.2.3-r4 is meaningless. It may work, but if it does
this is undocumented, and probably unintended, behaviour and may change
at any time. 


-- 
Neil Bothwick

The human mind ordinarily operates at only ten per cent of its
capacity ... the rest is overhead for the operating system.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Momesso Andrea]

[-- Attachment #1: Type: text/plain, Size: 1146 bytes --]

On Wed, 11 Mar 2009 13:40:54 -0700
Michael Higgins <linux@evolone.org> wrote:

> Don't know the proper term, but I want to stop version updates for a
> while, yet allow package-rN updates...
> 
> I spent most of the last couple of days killing two bugs that were a
> serious drag on my laptop, involving kacpid hogging the CPU on a
> resume, or bay swap, and gnome panel freezing on > 7 open windows (a
> real deal killer). I'd like to spend a few months just using it now
> that it all works...
> 
> So with the latest kernel in the tree unmasked (kacpid bug fix) and a
> couple of patches and ebuilds in my overlay for a pair of unmasked
> x11 and gnome packages, what is the method to keep this 'world' in a
> 'set' and 'forgotten' state? '-)
> 
> Cheers,
> 

I wouldn't use a script for managing something as delicate ad updates.

Just have a look at your weekly "emerge --sync && emerge -uDNpv world"
and manually mask whatever you don't feel to upgrade (put in
package.mask the exact version so new upgrades/bugfixes will show up
again in future syncs).

My 2 cents.

---
TopperH
http://topperh.blogspot.com

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] How to "freeze" my Gentoo system

[Michael Higgins]

On Thu, 12 Mar 2009 09:56:47 +0200
Alan McKinnon <alan.mckinnon@gmail.com> wrote:

> On Wednesday 11 March 2009 22:40:54 Michael Higgins wrote:

> > Don't know the proper term, but I want to stop version updates for
> > a while, yet allow package-rN updates...
> 
> This doesn't seem to be a built-in feature of portage after a quick
> scan of the man pages. But I can think of a method to do it the long
> way round:
> 
> The atom syntax you want is 


Well, I finally got a tuit, the round type, and applied to this question.

I don't know about >~ or ~> syntax. Not sure if ~ will work in package mask. Maybe in package.unmask, though... which makes sense, to my understanding. To unmask ~anyversionof-1.2.3. 

But to package.mask? I can't make '~' work. So... what I want, I think, is >= in package.mask for the *next* version update, so it doesn't get pulled in anywhere.

Here's the command line I used:

qatom $(qlist -ICv) | awk '{print ">="$1"/"$2"-"$3}' |\
sort -u | perl -pe 's/^(.+(?:\.|-))(\d+)(?>([-_.\da-z]*))$/$1.($2+1)/ge' | \
grep -Pv $( echo $( eix -inc -\* |cut -d " " -f 2 ) |tr " " "|" ) >> /etc/portage/package.mask

Anyway, that is what I wound up with. Unless I'm totally off, it works by removing funky version strings (that hideous regex) and bumping up by a digit whatever is left, skipping anything that is slotted (eix -inc).

(We can't mask in a slot, AFAIK, but maybe someone else does know.)

I deeply, newly updated system and world, ran the script above and repeated the deep new update to system and world. The list passed, in that I didn't mask any currently installed packages. '-)

And today I got no updates to install after syncing the tree. Good so far.

Time will tell, of course, if this really works. If there are no ebuilds offered with revision numbers, or new -rc -pre -whatever, I won't be bothered by them, is the plan. That is, if portage doesn't see 1.2.-rc_9999 as >=1.3 -- which is shouldn't, right? ;-)

Then one day I'll remove my additions to package.mask and spend a day pulling out my hair (or watching the new, magic portage do it's beautiful thing...) but that's better than possibly doing that several times a month. And this without ignoring any revisions, bug fixes, and the like.

Cheers,

-- 
 |\  /|        |   |          ~ ~  
 | \/ |        |---|          `|` ?
 |    |ichael  |   |iggins    \^ /
 michael.higgins[at]evolone[dot]org

Re: [gentoo-user] How to "freeze" my Gentoo system

[Mark David Dumlao]

On Thu, Mar 12, 2009 at 4:13 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
> On Thursday 12 March 2009 10:07:03 Dale wrote:
>> I do understand that getting something stable and working then wanting
>> to keep it that way.  I'm just wondering what his mileage may be in the
>> long run.
>
> I can only imagine what will happen if he forgets that package.mask and then
> removes it six months later:-)

I too, have spent a couple of days wondering what was masking a
package before remembering that it was me.

Re: [gentoo-user] How to "freeze" my Gentoo system

[Michael Higgins]

On Fri, 3 Apr 2009 10:45:46 +0800
Mark David Dumlao <madumlao@gmail.com> wrote:

> On Thu, Mar 12, 2009 at 4:13 PM, Alan McKinnon
> <alan.mckinnon@gmail.com> wrote:
> > On Thursday 12 March 2009 10:07:03 Dale wrote:
> >> I do understand that getting something stable and working then
> >> wanting to keep it that way.  I'm just wondering what his mileage
> >> may be in the long run.

Here's the first significant result with a sync today:

These are the packages that would be merged, in reverse order:

Calculating dependencies... done!
[ebuild     U ] app-text/xpdf-3.02-r2 [3.02-r1] USE="-nodrm" LINGUAS="-ar -el -he -ja -ko -la -ru -th -tr -zh_CN -zh_TW" 0 kB

Total: 1 package (1 upgrade), Size of downloads: 0 kB

Ahh. ;-)

I guess what's important, unless I see some particular reason to upgrade something, would be this:

glsa-check -tv affected
This system is affected by the following GLSAs:
200808-09 ( OpenLDAP: Denial of Service vulnerability ) 
200903-11 ( PyCrypto: Execution of arbitrary code ) 

 for glsa in `glsa-check -t affected` ; do glsa-check -p $glsa ; done
This system is affected by the following GLSAs:
Checking GLSA 200808-09
The following updates will be performed for this GLSA:
     net-nds/openldap-2.4.11-r1 (2.3.41)

Checking GLSA 200903-11
The following updates will be performed for this GLSA:
     dev-python/pycrypto-2.0.1-r8 (2.0.1-r6)


In the interest of writing really ugly bash scripts:

# for glsa in `glsa-check -t affected` ; do equery d $( glsa-check -p $glsa |grep -P '^\s+\w+-\w+/' | perl -pe 's/^\s+(\w+-\w+\/.+)-\d[\d.].+/$1/' ) ; done

This system is affected by the following GLSAs:
[ Searching for packages depending on net-nds/openldap... ]
app-admin/sudo-1.7.0 (ldap? >=net-nds/openldap-2.1.30-r1)
app-crypt/gnupg-2.0.10 (!static & ldap? net-nds/openldap)
                       (ldap? net-nds/openldap)
app-emulation/wine-1.1.12 (ldap? net-nds/openldap)
dev-db/postgresql-base-8.3.5 (ldap? net-nds/openldap)
dev-libs/apr-util-1.3.4 (ldap? =net-nds/openldap-2*)
gnome-base/gconf-2.24.0 (ldap? net-nds/openldap)
gnome-extra/evolution-data-server-2.24.5-r2 (ldap? >=net-nds/openldap-2.0)
mail-client/claws-mail-3.7.1 (ldap? >=net-nds/openldap-2.0.7)
net-firewall/ipsec-tools-0.7.1 (ldap? net-nds/openldap)
net-fs/samba-3.0.33 (ldap? net-nds/openldap)
net-misc/curl-7.19.4 (ldap? net-nds/openldap)
net-misc/openssh-5.1_p1-r2 (ldap? net-nds/openldap)
net-misc/openswan-2.4.13-r2 (ldap? net-nds/openldap)
net-print/cups-1.3.9-r1 (ldap? net-nds/openldap)
www-servers/apache-2.2.10 (ldap? =net-nds/openldap-2*)
[ Searching for packages depending on dev-python/pycrypto... ]
sys-apps/portage-2.1.6.7 (!build? >=dev-python/pycrypto-2.0.1-r6)

Looks like I can fix the use flag and clean out ldap if I want to do so, but I'm stuck with pycrypto (or the build use flag):

 euse -i build
global use flags (searching: build)
************************************************************
[-    ] build - !!internal use only!! DO NOT SET THIS FLAG YOURSELF!, used for creating build images and the first half of bootstrapping [make stage1]

... that's pretty clear. '-)


> >
> > I can only imagine what will happen if he forgets that package.mask
> > and then removes it six months later:-)
> 
> I too, have spent a couple of days wondering what was masking a
> package before remembering that it was me.
> 

And just to see if there's any upside evident:

mv /etc/portage/package.mask /etc/portage/package.mask.bak && emerge -puDNtv system && mv /etc/portage/package.mask.bak /etc/portage/package.mask

These are the packages that would be merged, in reverse order:

Calculating dependencies... done!
[ebuild     U ] net-misc/openssh-5.2_p1-r1 [5.1_p1-r2] USE="X pam tcpd -X509 -hpn -kerberos -ldap -libedit -pkcs11% (-selinux) -skey -smartcard -static" 993 kB
[ebuild     U ] sys-devel/gcc-4.3.3-r2 [4.3.2-r3] USE="fortran gtk mudflap nls openmp (-altivec) -bootstrap -build -doc (-fixed-point) -gcj (-hardened) -ip28 -ip32r10k -libffi (-multilib) -multislot (-n32) (-n64) -nocxx -nopie -objc -objc++ -objc-gc -test -vanilla" 58,063 kB

Total: 2 packages (2 upgrades), Size of downloads: 59,055 kB

Hmm.

# mv /etc/portage/package.mask /etc/portage/package.mask.bak && emerge -puDNtv world && mv /etc/portage/package.mask.bak /etc/portage/package.mask

These are the packages that would be merged, in reverse order:

Calculating dependencies... done!
[ebuild     U ] dev-java/sun-jre-bin-1.6.0.13 [1.6.0.12] USE="X alsa nsplugin odbc" 78,284 kB [0]

(... and some perl modules).


So, that's ssh, gcc and java I can pass on today... figure I can unmask in a month and update any of these packages, if I feel like it. But, http://bugs.gentoo.org/buglist.cgi?quicksearch=xpdf (search on the one update I took), it looks like there was a good gentoo reason and maybe a good gentoo response. 

As I understand it, if the maintainer thinks the recent changes/patches are significant, I'll get a -rN for a new ebuild.

OTOH, If there's a new version of something I care about tracking new releases, I'll unmask it. If there's a security thing, I can do the same...

Maybe any other ebuilds offered in the tree can wait until I see what happens to everyone else first. ;-)

. . .

Meanwhile, I do know that there's a security hole found on something I have installed from an overlay, where the fix was released in a new version upstream. So there's one downside, anyway.

Cheers,

-- 
 |\  /|        |   |          ~ ~  
 | \/ |        |---|          `|` ?
 |    |ichael  |   |iggins    \^ /
 michael.higgins[at]evolone[dot]org

[gentoo-user] Re: How to "freeze" my Gentoo system

[ABCD]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Higgins wrote:
> Looks like I can fix the use flag and clean out ldap if I want to do so, but I'm stuck with
> pycrypto (or the build use flag):

Actually, sys-apps/portage has a PDEPEND on "|| ( >=dev-lang/python-2.5
>=dev-python/pycrypto-2.0.1-r6 )", so if you are using
>=dev-lang/python-2.5, then you don't need pycrypto anyway.

- --
ABCD
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAknW0t8ACgkQOypDUo0oQOq/OACfWVcahpyEAy579NHcGQFZ3Fq5
+j4AoL30wLhP9YH4RsjmvrG1xxzFXiMc
=wG48
-----END PGP SIGNATURE-----