Re: [Security-Discuss] security advisories web page out of sync with mailinglist (fwd)

[email protected] deilvery failed...

-- 
Stew Benedict - Mandriva

---------- Forwarded message ----------
Date: Mon, 17 Jul 2006 10:16:34 -0400 (EDT)
From: Stew Benedict <[email protected]>
To: Antonio <[email protected]>
Subject: Re: [Security-Discuss] security advisories web page out of sync
    with mailinglist


On Mon, 17 Jul 2006, Antonio wrote:

> >Afaik kernels are treated the same by Mandriva Update and urpmi, 
> >regardless of whether it's a new kernel or an update. That is, they aren't 
> >installed automagically.
> >
> >That's why the kernel advisory includes this link:
> >
> >http://www.mandriva.com/en/security/kernelupdate 
> >
> >Why xine-lib was skipped, I don't know. If you see the GUI tool 
> >consistantly overlooking packages that urpmi picks up, I'd suggest filing 
> >a bug in bugzilla and see if you can get the maintainer to look at.
> >
> >-- 
> >Stew Benedict - Mandriva
> 
> mmh... perhaps I have not explained well it ... the problem isn't 
> MandrivaUpdate didn't installed the kernel update automagically, the problem 
> is MandrivaUpdate didn't find the kernel update at all. The fact I noticed 
> there was a kernel update was a stroke of luck (I was surfing a web site 
> dedicated to mandriva and noticed the news.. so looked on the mirrors and 
> found it).

afaik Mandrivaupdate has never shown the kernels

> It's not the first time I've seen MandrivaUpdate failed to find updates, so I 
> report here what happened in the past with xine-lib:
> 1. I launched on a console urpmi.update -a
> 2. Then launched urpmi --update --auto --auto-select --no-install --noclean
> 3. This founded the updates (not only the xine-lib), then I checked it for 
> viruses and signatures
> 4. Instead of install with urpmi I launched MandrivaUpdate, that found the 
> other updates but not the xine-lib
> 5. So I exited MandrivaUpdate and checked the security advisory web page, 
> where I found that xine-lib IS really a security update (and not for example 
> a rpm putted on the mirror by a ugly cracker ;-)
> 6. Finally I installed the updates with urpmi without problems, but since that 
> time I cannot more make confidence on my MandrivaUpdate, and I must go for 
> the manual urpmi.
> 
> Maybe my rpm structure and dependency are broken,  or maybe this is a problem 
> related to the community branch (I cannot remember well, but when I was on 
> official branch I think kernel was updated by MandrivaUpdate).
> In any case, regard the kernel, can you confirm me that now the normal 
> procedure is that I have to manually look for updates (looking at the web 
> page) and then install with urpmi? (manually looking for kernel security 
> updates seems to me strange).

Yes, afaik, that is the procedure. MandrivaUpdate does not show the 
kernels. Each kernel is a distinct package, so in the eyes of 
rpm,urpmi,mandrivaupdate they aren't "updates" to the previous one. This 
is why the special procedure is needed.

But it should have shown xine-lib (if you already had it installed).
If you find packages other than kernel show in urpmi but not 
MandrivaUpdate, I'd suggest filing a bug. 

-- 
Stew Benedict - Mandriva
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________