[pca] Using a White List with pca

[Martin Paul]

Fred Chagnon wrote:
> I can specify the path to the archive (-P), but if a patch is missing or
> outdated, pca will try to download it. This is a problem firstly because
> from the client pca will not have write permissions to the patch archive,
> and secondly because we likely have not inspected and tested the patch being
> fetched. If I could simply have pca fail gracefully if the patch doesn't
> exist in the archive and continue the attempt to apply further patches this
> would be the best option, but there doesn't seem to be a way to do that.

I think it would be better to use "patchurl=file:/path/to/archive" 
instead of "-P". pca will then use the directory as a read only 
ressource from where it "downloads" patches. If user/passwd are not set, 
pca will never try to download patches from SunSolve, BTW. If a patch 
can't be found in patchurl, pca will continue with the next one.

> Is there a way to get pca to behave the way I want, or am I trying to put a
> square peg in a round hole?

Hmm, yes, it could be that you're using the wrong tool. In its heart, 
what pca does is to investigate which patches are missing from a system 
and in which order to apply them to get a fully patched system. In your 
setup, it's the admins who decide which patches should be installed. It 
doesn't mean that you can't use pca to download/install patches, though.

As I understand it, you already have a list of patches to be installed, 
like this:

   123456-78
   234567-89
   ...

What about a wrapper which uses the list plus output from "patchadd -p" 
to decide whether a patch is already installed, and (if not), install 
the patch with "pca --install 123456-78"? You will have to take care of 
patch dependencies by yourself - when you leave that to pca, you always 
risk having a new, untested patch being added to the list of patches to 
be installed. pca will also be helpful to find out about new patches 
which you will then check and add to your list of patches, if needed.

Hope that helps,

Martin.