[pca] New Sun policy on security/recommended patch versions

[Martin Paul]

Craig Bell wrote:
> Martin Paul wrote:
> I tend to see "missingr" as a modifier to "missing", which gets the
> current revision.  If the "r" suffix becomes minimal, then "missingr"
> seems ambiguous.  Now what about "s", which always promotes?  Xref is
> yet more inconsistent...

Another idea would be to add another suffix "c" to specify the cluster 
with the minimum revisions, and leave "r" as it is. I'm afraid that this 
might be even more confusing to new users, though.

I've also thought about getting rid of "rs" (any patch with "R" or "S" 
set), as all "S" patches should be "R" anyway. But there are some 
exceptions to that right now, so I'll see whether these will be fixed 
before I change anything.

> Incidentally, could the S flag get the minimal treatment?

According to what I've heard, it's not likely that the S flag will 
change (soon). I'd like to have it consistent with R, specifying the 
minimum revision, too.

> In any case, I'm happy to update my syntax, if it keeps things clear
> and simple.  -cheers, CSB

I will only make any downward incompatible change if I'm really 
convinced that it makes things simpler and more straight-forward.

> P.S. In practice, minimal R patching does little for me, as I still
> need to apply the same total number of patches.

That's actually the big question, and Oracle (I really have to get used 
to write that instead of Sun :) ) made the change especially for the 
reason to reduce the amount of patches to be installed with periodic 
patch cycles. It was hard to estimate the effect of the change, but as a 
litte more than two weeks have gone by, I've now conducted a little 
experiment:

Imagine a machine patched with all Recommended patches as of 2010/06/01 
with "pca -i missingr". Now compare the number of Recommneded patch as 
of today, once with the old behaviour of promoting the R flag to the 
latest revision, once with the new behaviour and the minimal revision:

   $ pca -l missingr --noheader | wc -l
          5
   $ pca -l missingr --noheader --minimal | wc -l
         21

That's a rather big difference - 16 patches less to be installed, one of 
them being the current revision of the kernel patch. On the other hand, 
the reduced patch set still includes at least one patch which requires a 
reboot, so one doesn't gain much in that regard.

> If Oracle challenges my patches during a service request, I'll bet
> it's because I'm behind, not ahead. =-)

That's actually a very important point you make here. Will support 
continue to ask "are ALL patches installed?" as the first question - as 
often has been reported - defeating any purpose of reducing the number 
of required/recommended patches?

Martin.