[Mageia-dev] Backports policy clarification (and discussion)

[blind Pete]

Samuel Verschelde wrote:

> I re-read the backports policy, and there's a part I think needs to be
> pointed out before people start to backport packages.
> 
> "We need to ensure that upgrades never fail: cauldron must always have a
> higher version/release than in stable releases."
> 
> This statement is true, but implies more than what it says. It means that
> we can't backport a package for Mageia 1 with a higher version than what
> we have in Mageia 2 release (and updates?) media. And this, until we are
> able to take backports into account during upgrades.
> 
> Example :
> - Mageia 2 has wesnoth 1.10.2 in core/release
> - Mageia 1 can't get a higher version in its backports media
> 
> Do you all agree with my understanding of the policy ?
> 
> This is a serious limitation to our ability to backport to Mageia (n-1)
> and even to our ability to provide security fixes to backports there (will
> not prevent it, but will prevent to do it by a version upgrade, which is
> the common way to fix that kind of issue in backports).
> 
> Maybe we shouldn't open backports for Mageia 1, and make sure upgrade to
> Mageia 3 can take backports from Mageia 2 into account so that backports
> to Mageia 2 are not stopped when Mageia 3 is released. Then we'll be safe.
> 
> Samuel

This might be an interesting way to restate the problem...  

Imagine that example package 1 (ex1) is in mga1 _at the time of release_. 
Ex2 is in mga2 _at the time of release_. 
Ex3 is in mga3 _at the time of release_. 
Ex4 is in cauldron. 

Ignore backports for a moment, and imagine that there has been a 
monumental security breach in the example package such that 
versions one and two are completely untrustworth and Ex3.1 is 
recommended for everyone.  

The obvious thing to do is push updates of Ex3.1 to mga3, mga2, 
and mga1, in that order.  

What happens to a system running mga1 plus updates when you 
attempt to update it?  Would the old ISOs be withdrawn?  
Or re-released with Ex3.1?
Or would you have to wait for an emergency release of mga4?  
Or could a separate "update" iso be released along side 
the pre-existing isos?  
Or could on-line updates be made compulsory?  

-- 
blind Pete
Sig goes here...