locked packages got upgraded anyway

Rainer Duffner rainer at ultra-secure.de
Wed Oct 14 19:14:26 UTC 2015


> Am 14.10.2015 um 16:59 schrieb Mark Felder <feld at freebsd.org>:
> 
> 
> 
> He has a valid use case and I don't know why it was upgraded. Sounds
> like a bug. Perhaps because it was a dependency? Hmm...
> 
> A planned* feature is for a user to be permitted to have packages with
> custom build options and "pkg upgrade" will handle fetching the required
> parts of the ports tree and building the updated package so you don't
> have to play this "lock your package, manually upgrade it later" game.
> Not everyone should be forced to run poudriere just so they can change
> one option on one package...



Well, I feel the reality is different.
„Should have“ or „Should not have“ doesn’t buy you anything in the end ;-)

It’s probably not a problem locking a package with no dependencies.
But do you have to lock the dependencies, too?
I’m too afraid of the outcome, so I don’t even try.
And if you’re running poudriere for a couple of packages already, you can just let it build the rest, too.
IMO.

The only thing I found useful was locking pkg itself.
That way, I could downgrade everything to an earlier cut of the ports-tree (except for pkg, which would probably have had problems reading the newer version of the pkg-db created by a more recent version of pkg).

I realize not everyone wants to run their own repo - but in practice, this is currently the best way to do it if you’re not 100% happy with what you get from the official repo, with the least possible ways to totally F-U.
I, too, would be glad if there were „flavors“, so I could stop running my own build-server and just mirror the official repo, like we do for Ubuntu and CentOS.
But in the end of the day, I live in reality, not in la-la-land.

I appreciate all the work done by the committers on the ports-tree and packages - I save an absurd amount of time just by walking in these foot-steps.






More information about the freebsd-pkg mailing list