locked packages got upgraded anyway

[Mark Felder]

On Tue, Oct 13, 2015, at 17:42, Rainer Duffner wrote:
> 
> > Am 14.10.2015 um 00:31 schrieb Benjamin Connelly <ben at electricembers.coop>:
> > 
> > We have a few ports we compile with different compile time options than the FreeBSD binary repo, so we keep them locked. Last night when doing some patching, we saw those locked packages get updated anyhow. For example, pkg said all of these things on one system:
> > 
> 
> 
> IMO, you either compile all of the packages you use yourself - or none.
> 
> Until FreeBSD gets a sort of „stable“ ports-tree that lives for longer
> than three months, running your own repo is almost a must for anything
> even semi mission-critical.
> 

He has a valid use case and I don't know why it was upgraded. Sounds
like a bug. Perhaps because it was a dependency? Hmm...

A planned* feature is for a user to be permitted to have packages with
custom build options and "pkg upgrade" will handle fetching the required
parts of the ports tree and building the updated package so you don't
have to play this "lock your package, manually upgrade it later" game.
Not everyone should be forced to run poudriere just so they can change
one option on one package...

* Planned as in "bapt or someone said we should do this when we have
time"


-- 
  Mark Felder
  ports-secteam member
  feld at FreeBSD.org