[pca] PCA not reporting on patches that may need to be re-installed

[Martin Paul]

Hi Norman,

To begin with - I'm far from being a Sun patch guru, I'm still learning 
something new from time to time :) Maybe Don O'Malley can add something 
to the subject as well.

> I've run into problems where a patch may need to be re-installed if 
> someone has added a package after patching.  PCA does not seem to catch 
> this.

Yes, that's right. The issue comes up from time to time, it's a known 
deficiency in Sun's (or better, SysV) package and patch system. As you 
correctly explained in your example in a later message, the problem is:

   - Install package A
   - Install patch 1, which contains fixes for package A and B
   - Install package B
   -> You end up with patch 1 being only partly installed.

Some time ago, I came up with a script in an attempt to automatically 
find out affected patches. I'm attaching it, feel free to try it on one 
of your systems to see if it helps you to identify problematic patches 
(and let us know).

Later, I thought about an approach to fix this in pca. The idea is: For 
every patch, don't only check whether it's in "showrev -p" but check 
whether all of the installed packages included with a patch are listed 
in "showrev -p". In the above example, only package A would be listed in 
"showrev -p" for patch 1, so I would have identified a partly installed 
patch. I would just list those as "missing" like any other patch which 
isn't installed at all.

Unfortunately it turned out that it's not so simple. The main problem 
was patches which contained fixes for packages which only apply to a 
certain architecture. E.g. there's a patch for "FJSVvplu", but it only 
contains "FJSVvplu.us". So if you install this patch on a sun4u machine, 
FJSVvplu will not show up in "showrev -p" and pca thought it had found a 
partly installed patch.

At that time, I decided to remove the new code again, as I couldn't 
think of a way to work around this.

The real reason why this isn't a bigger problem is of course that most 
people will install a certain package set when setting up a machine and 
this package set never changes. Personally, I never use pkgadd/pkgrm 
with Solaris packages on my machines.

Actually, as far as patches are concerned, your best bet is to install 
"Entire Distribution" and be done with it. I know, I've been telling 
people to only install required software many times in the past as well 
for security reasons, but it seems as if Sun only tests on "Entire 
Distribution" as well. Imaging patch 1 for package A, which is in the 
core cluster. It requires patch 2 for package B, which is only in one of 
the bigger clusters. You will not be able to install patch 1. This is 
not theory, I've had such issues reported to me.

So I'm afraid there won't be a simple solution to this. If possible, use 
static package sets on your machines. If not, use the supplied "pip" 
script to find out affected patches, and re-install them.

Martin.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: pip
Url: https://lists.univie.ac.at/mailman/private/pca/attachments/20090323/302c0e7f/attachment.pl