<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:12pt"><div>I did understand it the first time, but thanks again for the further clarification. This kinda illustrates my point. Couldn't you have a different repo with these updates maintained by other community members, under the guidance of the 'core'. Ppl could decide whether to trade-off security vs compatibility/reliability. I suppose your counter argument there is that there is nothing stopping that happening outside of CentOS project.<br><br>Anyway, I am sure you have better things to do than argue the toss with me on a Sunday! ;o)<br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Johnny
Hughes <johnny@centos.org><br><b><span style="font-weight: bold;">To:</span></b> CentOS mailing list <centos@centos.org><br><b><span style="font-weight: bold;">Sent:</span></b> Sunday, 9 August, 2009 13:54:50<br><b><span style="font-weight: bold;">Subject:</span></b> Re: [CentOS] CentOS Project Infrastructure<br></font><br>Johnny Hughes wrote:<br>> Ian Murray wrote:<br><br><snip><br><br>> WRT to the one valid issue that you raise ... let me explain the<br>> TECHNICAL reason why you can not release these things hodge podge.<br>> <br>> First ... Red Hat releases point releases at regular intervals (3-4<br>> times per year).<br>> <br>> Second ... we do not release anything that does not pass our checks and<br>> is linked to the same libraries as upstream.<br>> <br>> Now, when the upstream provider does a point release, that means they<br>> have released a whole bunch of NEW libraries. It also
means that every<br>> single update that comes out after their point release is built against<br>> the NEW libraries and not the OLD libraries.<br>> <br>> We can NOT build and release the security updates you talk about against<br>> the OLD libraries that you have installed on your machine (prior to the<br>> point release) as it will make the NEW updates we are building NOT like<br>> they are upstream.<br>> <br>> We have to build the new updates against the point release instead. The<br>> point release will either not be done yet (it takes time to build) or in<br>> testing/qa and not yet released. When we build against it, we will have<br>> to release all the pieces that are required to also get the updates you<br>> are talking about.<br>> <br>> That is the problem ... therefore, we HAVE to finish the point release<br>> and get it out before we can build new updates released after the
point<br>> release. This is not new, it has been an issue since the first rebuild<br>> more than 5 years ago.<br>> <br>> People who do not understand the technical issues involved do not see<br>> why we can't just snap our fingers and put out the packages ... well, we<br>> can't.<br><br>Let me get even a bit more technical.<br><br>Firefox-x.y.z gets released after the CentOS-A.b release.<br><br>Firefox needs nss-x.y.z-3. The released version of nss before the<br>CentOS-A.b is nss-x.y.z-2.<br><br>No problem, build the new nss-x.y.z-3 first, then build Firefox-x.y.z.<br><br>Well, dang, nss-x.y.z-3 needs nspr-x.y.z-99 and nspr-x.y.z-98 is<br>currently in CentOS-A.b ... so now we need to also build nspr-x.y.z-99.<br><br>There is a new version of glibc and gcc in the point release and it<br>corrects ISSUE #ABCDE in the bugzilla, which impacts Firefox-x.y.z, so<br>we have to build those 2 things to. They require PackageQ
and PackageT<br>to be rebuilt.<br><br>Now, while we are trying to figure out the complex relationships<br>required to build firefox, would could have been testing and producing<br>the point release. Add a couple more updates and what you have is a<br>hodge podge mess of things released at different times.<br><br>You are also introducing bugs into CentOS that are not upstream in this<br>kind of scenario (firefox-x.y.z running against xorg-x.y.z-3 does this<br>thing ... but when running against xorg-x.y.z-4 it does not).<br><br>Hopefully I am making this issue clear.<br><br></div></div></div><br>
</body></html>