Prevent packages from switching from repo to repo

[Benjy Grogan]

Hello,

Is there a way of preventing a package from updating to a more recent
package from another repo?  I have several repos enabled, and I
noticed today that one package was set to be updated to one from
another repo.  So package foo from Fedora Extras was going to be
updated to a new release ( minor/major version the same though) from
Livna.  Seems like that's almost always unwanted behaviour.  Is there
a way of avoiding these situations with yum, and then in turn possibly
with Pup?

Benjy

[Jef Spaleta]

On 8/6/06, Benjy Grogan <benjy.grogan(a)gmail.com&gt; wrote:
>  Seems like that's almost always unwanted behaviour. 
Depends
on your personal preferences.  I doubt we could agree that
'most' people would prefer the audacity package from Extras over the
audacity package from livna which includes the mp3 support for
example.

>  Is there
>  a way of avoiding these situations with yum, and then in turn possibly
>  with Pup? 
Clever users can craft yum repository configuration files with
explicit  exclude and includepkgs lines which narrowly target such
situations as their personal situation demands.  But then again a
detail discussion of such situational configuration is best hashed
over in a non development list.

-jef"dark cholocate m&m's are back!!!!!!!!!"spaleta

[Kevin Kofler]

Benjy Grogan <benjy.grogan <at> gmail.com> writes:
>  Is there a way of preventing a package from updating to a more
> recent
>  package from another repo?  I have several repos enabled, and I
>  noticed today that one package was set to be updated to one from
>  another repo.  So package foo from Fedora Extras was going to be
>  updated to a new release ( minor/major version the same though) from
>  Livna.  Seems like that's almost always unwanted behaviour.  Is there
>  a way of avoiding these situations with yum, and then in turn possibly
>  with Pup? 
If you mean comical, that one is permanently moving to Livna (getting dropped 
from Extras) because of licensing issues with the included RAR decompression 
code. See:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190278

        Kevin Kofler

[Arjan van de Ven]

On Mon, 2006-08-07 at 01:51 +0000, Kevin Kofler wrote:
>  Benjy Grogan <benjy.grogan <at> gmail.com> writes:
>  > Is there a way of preventing a package from updating to a more recent
>  > package from another repo?  I have several repos enabled, and I
>  > noticed today that one package was set to be updated to one from
>  > another repo.  So package foo from Fedora Extras was going to be
>  > updated to a new release ( minor/major version the same though) from
>  > Livna.  Seems like that's almost always unwanted behaviour.  Is there
>  > a way of avoiding these situations with yum, and then in turn possibly
>  > with Pup?
>  
>  If you mean comical, that one is permanently moving to Livna (getting dropped 
>  from Extras) because of licensing issues with the included RAR decompression 
>  code. See:
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190278 
I thought Livna refused packages which the livna people consider a
problem as well?

[Kevin Kofler]

Arjan van de Ven <arjan <at> fenrus.demon.nl> writes:
>  I thought Livna refused packages which the livna people consider a
>  problem as well?  
Well, the issues here are that the licensing isn't quite Free Software (or Open 
Source), but otherwise it isn't any more of a problem than some of the other 
packages Livna ships. They ship unrar itself under the same license, for 
example. And then there's the infamous proprietary kernel mod... err... let's 
not bring that flamewar up again! If you still think the licensing of Comical 
is not acceptable even for Livna, you'll have to bring that up with the Livna 
people. As the saying goes, don't shoot the messenger. ;-)

        Kevin Kofler

[Benjy Grogan]

On 8/6/06, Kevin Kofler <kevin.kofler(a)chello.at&gt; wrote:
>  Benjy Grogan <benjy.grogan <at> gmail.com> writes:
>  > Is there a way of preventing a package from updating to a more recent
>  > package from another repo?  I have several repos enabled, and I
>  > noticed today that one package was set to be updated to one from
>  > another repo.  So package foo from Fedora Extras was going to be
>  > updated to a new release ( minor/major version the same though) from
>  > Livna.  Seems like that's almost always unwanted behaviour.  Is there
>  > a way of avoiding these situations with yum, and then in turn possibly
>  > with Pup?
>
>  If you mean comical, that one is permanently moving to Livna (getting dropped
>  from Extras) because of licensing issues with the included RAR decompression
>  code. See:
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190278 
Yep, it's Comical.  Is this that rare of a situation that you can
pinpoint the rpm?  In this case I don't mind the repo switch if Extras
no longer will hold Comical.  But shouldn't there be a warning message
that pops up when a repo switch occurs?  It's not really a situation
of prohibiting this behaviour with protectbase, or allowing it by
default, but more or less being able to be aware that the rpm is being
pulled from another repo.  I was curious and discovered this in the
details.  Seems like a feature that would be worth putting into Pup,
along with the standard 'do you want to see this warning in the
future?'.

Benjy

>          Kevin Kofler
>
>  --
>  fedora-devel-list mailing list
>  fedora-devel-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-devel-list
>

[Jef Spaleta]

On 8/9/06, Benjy Grogan <benjy.grogan(a)gmail.com&gt; wrote:
>  Yep, it's Comical.  Is this that rare of a situation that you
> can
>  pinpoint the rpm?  In this case I don't mind the repo switch if Extras
>  no longer will hold Comical.  But shouldn't there be a warning message
>  that pops up when a repo switch occurs?  It's not really a situation
>  of prohibiting this behaviour with protectbase, or allowing it by
>  default, but more or less being able to be aware that the rpm is being
>  pulled from another repo.  I was curious and discovered this in the
>  details.  Seems like a feature that would be worth putting into Pup,
>  along with the standard 'do you want to see this warning in the
>  future?'. 
Which field in rpmdb on your system do you think makes the best guess
as to which repo a currently installed version of a package is from?
There is no header field that can garuntee to catch a repository
change since the rpmdb does not record the url from which the package
came.  Vendor fields are not authorative, Packager fields are not
authorative.  Buildhost is not authorative.  At best you can do a
signature comparison to check to see if a package is signed by the
same key as the update(which will I would expect noticable slow down
the update process). Obviously this only works for signed packages,
and even signature comparisons will not catch all repo by repo changes
IF the same key is used to sign packages for multiple repos.  It will
catch a jump from extras to livna, but not something like a jump from
Core to updates or updates to updates-testing, which i think are still
all signed with the same key(s). Nor is key checking going to work for
mongrel repos, which have packages built and signed from other
locations in the same repository structure.

There simply is no repository heritage information stored in the rpmdb
about currently install packages which can be considered authorative
for all possible situations.  The closest thing is a signature change.
And while I have illustrated that checking for a signature change
isn't perfect I think such an optional check does have value. A change
of signature with a package update is definitely something I would
followup on before allowing an update if I were notified of that
situation. But I'm far from a regular user, and I couldn't fathom
whether or not this sort of 'red flag' would be beneficial to the
99.9% of the users closer to the median than I. For all I know this
information would only be ignored as a nag dialog and summarily
ignored.

-jef"completely underwhelmed by the skeeters here"spaleta

[Matt Domsch]

On Sun, Aug 06, 2006 at 08:44:34PM -0400, Benjy Grogan wrote:
>  Hello,
>  
>  Is there a way of preventing a package from updating to a more recent
>  package from another repo?  I have several repos enabled, and I
>  noticed today that one package was set to be updated to one from
>  another repo.  So package foo from Fedora Extras was going to be
>  updated to a new release ( minor/major version the same though) from
>  Livna.  Seems like that's almost always unwanted behaviour.  Is there
>  a way of avoiding these situations with yum, and then in turn possibly
>  with Pup? 
protectbase in yum-utils.


-- 
Matt Domsch
Software Architect
Dell Linux Solutions linux.dell.com & www.dell.com/linux
Linux on Dell mailing lists @ http://lists.us.dell.com