[pca] New Sun policy on security/recommended patch versions

[Martin Paul]

Paul B. Henson wrote:
> I was thinking about the new policy on only patch versions actually
> containing a new fix being marked security/recommened, rather than the most
> recent version. My understanding is ..

.. correct. Just be aware that the change only affects the Recommended
flag, making exactly those patch revisions recommended which are
included in the "Recommended Patch Cluster". There has been no similar
change to the Security flag, and there are no plans for it (although I'd
find that useful).

> For example, if there was a patch 12345-10 marked recommended, and a newer
> version 12345-15 available, currently a 'pca -l missingrs' on a system
> with 12345-10 installed would list 12345-15 as a "new" recommended patch.
> By considering 12345-10 to be the most recent when loading the pca data
> structures, 'pca -l missingrs' would no longer indicate 12345-15 was
> necessary to have all recommended patches.

I think you describe exactly what the new (experimental) "--minimal"
option does. It applies when pca reads the xref file, and it will ignore
later non-R revisions if it has seen a revision marked as R for a given
patch already.

So with "pca --minimal --install missingr" you should be able to bring a
system to exactly the same state as by installing the current
"Recommended Patch Cluster".

> Thoughts? Pending some deeper reconstruction of pca to handle multiple
> versions for a patch, it seems useful to have the option of maintaining
> past behavior (currently available), as well as a way to avail of this new
> information, both working within the current limitations.

I've spent quite some time thinking about how to integrate the new kind
of information about the minimum recommended patch revision into pca's
command line options, but still haven't come to a conclusion.

One question is whether it's still necesssary to support the "old"
behaviour, where "pca -l missingr" shows the latest revision of each
recommended patch. If not, I would change pca to behave as if
"--minimal" was specified whenever a patch group argument with a 
trailing 'r' is seen. Like that, no new option would be needed.

On the other hand, it might make sense for some people to install the 
latest revision of all patches featuring a "Recommended" fix in any 
revision. E.g. if patch 123 isn't installed at all, 123-01 is marked 'R' 
and 123-02 is the latest, one has to install the patch anyway and could 
just use the latest revision as well without any additional risk.

In this second case, pca would need a way (option, patch group) to allow 
the admin telling it what exactly he means with "missingr".

This also affects the 'R' column in pca's output, e.g. when 123-01 is 
installed should 123-02 have an 'R' or be empty in "pca -l missingr" 
output? Only rev. 01 is marked 'R', and it is already installed. But 
with the old intepretation 123 still is a "Recommended" patch.

I've also thought a complete re-design of the whole "patch group" 
argument in pca to make it more flexible, but haven't found a simple but 
complete solution for that either. I'm open for ideas.

Martin.