--Op27XXJsWz80g3oF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Apr 17, 2006 at 11:47:56AM -0400, Steven M. Bellovin wrote:
> On Mon, 17 Apr 2006 11:18:14 -0400, Johnny Lam <jlam@pkgsrc.org> wrote:
>=20
> > I'm curious as to how many people are using the pkgsrc "stable" branche=
s=20
> > (pkgsrc-YYYYQQ).  The pkgsrc developers spend quite a bit of time=20
> > creating and maintaining these branches, and I want to get a feel for=
=20
> > whether this is time well-spent.
> >=20
> > I personally use the stable branch on production servers.  I find it=20
> > avoids the chaos of keeping up with rapidly changing PKGREVISIONs that=
=20
> > happen on pkgsrc HEAD at times.  I keep a sandbox handy for rebuilding=
=20
> > packages when there is a security update on the stable branch, and I=20
> > update all of my software to the newest stable branch every quarter.
> >=20
> > Is anyone else using the pkgsrc stable branch?  If so, how do you use i=
t?
>=20
> I'll tell you something you don't want to hear -- I tried it, but I gave
> up.  The problem is that security patches weren't pulled up quickly enough
> to the branches.  On stable machines, those are my primary reason for
> recompiling.

Fixing the PHP packages last week took me an insane amount of time;  I'm
glad that I can stretch my job description enough to consider it part of
my admin job, but I still have better things to do.  I committed the
patches on Friday, and just did the pull-up request, after proper test
that everything applied cleanly and compiled fine on the branch.

During that time, *anybody* (well, policy probably requires that the
requests come from developers, but that still include a lot of people)
could have done the same checks and request the pull-up.  I personally
don't use the stable branch, mostly because I haven't had the time to
prepare my setup in that respect.

--=20
Quentin Garnier - cube@cubidou.net - cube@NetBSD.org
"When I find the controls, I'll go where I like, I'll know where I want
to be, but maybe for now I'll stay right here on a silent sea."
KT Tunstall, Silent Sea, Eye to the Telescope, 2004.

--Op27XXJsWz80g3oF
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (NetBSD)

iQEVAwUBREUAvdgoQloHrPnoAQLsyQgAiHr3mX9T7P7BUc5QLzpADYUOd9/vXEvi
VPIryO99ScSyzxn34OZtcOJvdD8oCO2yc+DiDnRTc/6S/EEojqtxKEVTmXknzWRx
4sG04C7/E/UvgCs3BoDRULYV6ihCAy3yIuvv666EXPiDlD1AUVqQcx/Y8P2pXvQW
h5q+6kz4nhw2n/DDaslg+554npdmI58FDAKZRJai4J89feReblU4Dj+wfub13Fmu
rUP5x5kfSGo8BId+fer/TGM8sePCICocPR8vBVhJy3k1fHLhQp98HVg3nctcdyJr
VVPRDXK8xmVCqmnvCUBmdkSYGo+c5BGjdEPiL6+Gt/Ymn7rCkbfboA==
=mrxf
-----END PGP SIGNATURE-----

--Op27XXJsWz80g3oF--