[pca] PCA not reporting on patches that may need to be re-installed

[Norman Lyon]

My solution to the $PKG.$ARCH issue has been to cutoff the trailing  
architecture letters, if they match my particular architecture, along  
the lines of the following (please forgive the sloppiness, since this  
is quick and dirty, and doesn't look at the patchdiag.xref yet).  If  
this is too problematic, please let me know what problems you see with  
it (minus the fact that it's slow), since I'd plan on optimizing this  
in my code if it's not a reasonable fit for pca.

#!/bin/ksh
UNAMER=`uname -r`
UNAMEP=`uname -p`
UNAMEM=`uname -m`
SHOWREVP=`showrev -p`
INSTPKG=`pkginfo | nawk '{print $2}'`
PKGVERSION=`for pkg in $INSTPKG ; do
               printf "${pkg};" ; pkgparam $pkg VERSION
             done`
case `$UNAMEM` in
   sun4c)  cutoff='.c' ;;
   sun4d)  cutoff='.d' ;;
   sun4m)  cutoff='.m' ;;
   sun4u)  cutoff='.u' ;;
   sun4us) cutoff='.us';;
   sun4v)  cutoff='.v' ;;
   i86pc)  cutoff='.i' ;;
esac
for patch in $PATCHDIR/* ; do
   [[ -f $patch/patchinfo ]] && \
   egrep "^PATCH_OSRELEASE=.*${UNAMER}'*" $patch/patchinfo > /dev/null && \
   egrep "^PATCH_ARCH=.*${UNAMEP}" $patch/patchinfo > /dev/null && \
   PTCH=${patch##*/} && REV=${PTCH#*-} && PTCH=${PTCH%-*} && \
   LINES=`echo "${SHOWREVP}" | grep $PTCH` && \
   patch_need=0 && \
   for pkg in `ls -d1 ${patch}/*/install | nawk  -F/ '{print $(NF-1)}'` ; do
     ipkg=${pkg%${cutoff}}
     if [ `echo "${INSTPKG}" | grep -c "^${ipkg}\$"` -eq 1 ] ; then
       inst_ver="" && for i in ${PKGVERSION} ; do
         [[ "$i" != "${i#${ipkg};}" ]] && inst_ver=${i#*;} && \
           inst_ver=${inst_ver%%,*} && break
       done
       patch_ver="" && for i in `cat $patch/$pkg/pkginfo` ; do
         [[ "${i}" != "${i#VERSION=}" ]] && patch_ver=${i#VERSION=} && \
           patch_ver=${patch_ver%%,*} && break
       done
       if [ "$inst_ver" == "$patch_ver" ] ; then
         inst_ptch=`echo "${LINES}" | egrep "${PTCH}.* ${ipkg}(,|\$)" | \
                    sed -e 's/Patch: //' -e 's/Obsoletes: //' \
                        -e 's/ Requires:.*//' -e 's/,//g'`
         [[ -z $inst_ptch ]] && patch_need=1 ; have_rev=0
         for p in $inst_ptch ; do
           [[ "${p%-*}" == "${PTCH}" ]] && [[ ${p#*-} -ge ${REV} ]] &&  
have_rev=1
         done ; [[ $have_rev -eq 0 ]] && patch_need=1
       fi
     fi ; true
   done && [[ $patch_need -eq 1 ]] && echo ${PTCH}-${REV}
done

Quoting Martin Paul <martin at par.univie.ac.at>:

> Hi Norman,
>
> To begin with - I'm far from being a Sun patch guru, I'm still  
> learning something new from time to time :) Maybe Don O'Malley can  
> add something to the subject as well.
>
>> I've run into problems where a patch may need to be re-installed if  
>> someone has added a package after patching.  PCA does not seem to  
>> catch this.
>
> Yes, that's right. The issue comes up from time to time, it's a  
> known deficiency in Sun's (or better, SysV) package and patch  
> system. As you correctly explained in your example in a later  
> message, the problem is:
>
>   - Install package A
>   - Install patch 1, which contains fixes for package A and B
>   - Install package B
>   -> You end up with patch 1 being only partly installed.
>
> Some time ago, I came up with a script in an attempt to  
> automatically find out affected patches. I'm attaching it, feel free  
> to try it on one of your systems to see if it helps you to identify  
> problematic patches (and let us know).
>
> Later, I thought about an approach to fix this in pca. The idea is:  
> For every patch, don't only check whether it's in "showrev -p" but  
> check whether all of the installed packages included with a patch  
> are listed in "showrev -p". In the above example, only package A  
> would be listed in "showrev -p" for patch 1, so I would have  
> identified a partly installed patch. I would just list those as  
> "missing" like any other patch which isn't installed at all.
>
> Unfortunately it turned out that it's not so simple. The main  
> problem was patches which contained fixes for packages which only  
> apply to a certain architecture. E.g. there's a patch for  
> "FJSVvplu", but it only contains "FJSVvplu.us". So if you install  
> this patch on a sun4u machine, FJSVvplu will not show up in "showrev  
> -p" and pca thought it had found a partly installed patch.
>
> At that time, I decided to remove the new code again, as I couldn't  
> think of a way to work around this.
>
> The real reason why this isn't a bigger problem is of course that  
> most people will install a certain package set when setting up a  
> machine and this package set never changes. Personally, I never use  
> pkgadd/pkgrm with Solaris packages on my machines.
>
> Actually, as far as patches are concerned, your best bet is to  
> install "Entire Distribution" and be done with it. I know, I've been  
> telling people to only install required software many times in the  
> past as well for security reasons, but it seems as if Sun only tests  
> on "Entire Distribution" as well. Imaging patch 1 for package A,  
> which is in the core cluster. It requires patch 2 for package B,  
> which is only in one of the bigger clusters. You will not be able to  
> install patch 1. This is not theory, I've had such issues reported  
> to me.
>
> So I'm afraid there won't be a simple solution to this. If possible,  
> use static package sets on your machines. If not, use the supplied  
> "pip" script to find out affected patches, and re-install them.
>
> Martin.
>