[pca] PCA not reporting on patches that may need to be re-installed

[Norman Lyon]

Quoting Rajiv Gunja <opn.src.rocks at gmail.com>:


> To date I have not seen a package fail due to a missing patch. And I do not
> think any of the SUN's patching tools (EIS, SM, TLP) will do what you are
> asking for.
>
> I think there are couple SUN guys on this distribution and Martin himself is
> a patching|OS Guru, so I will leave it up to them to correct|comment on our
> views.

We've had numerous systems that have been hit by this sort of problem  
when it came time to patch to pre-requisite levels for Zone Update  
Live Upgrade out systems.  I also believe this problem is the reason  
behind certain unexplained problems we've seen after patching when we  
base our logic on just a grep of the patch out of showrev output.  Has  
this meant a package has failed?  Since I don't know what that means,  
I can't answer that.  But fixes that we need that were presented by a  
patch never made it onto the system, until re re-applied it.

As for if any existing patch checking tools do this, all it takes is  
knowing the problem is there, and writing code to handle it.  Some of  
Sun's stuff handles this by trying to apply all patches in a bundle  
(ignoring any initial check), but that logic presents other  
storage/bandwidth/etc issues in my enterprise (corporate security  
guidelines and hardening related).  My LU wrapper does this (once we  
ran into the problem), but it's much less efficient than PCA.  I was  
looking into the possibility of replacing my patch check code with PCA  
to optimize that code, but without this check, it can't meet my  
requirements (and since I'm a shell programmer who hasn't touched perl  
in about a decade, I wouldn't be anyone's first suggestion to modify a  
local copy of PCA, or submit code into the repository).  Hence my  
interest in this issue.  :)