When using multiple repo, then how would i know, an
app/lib from non-CentOS (that is, 3rd party repo) is going
to conflict or not with CentOS core, base, essential
app/lib packages ?
We need to know CentOS core, base, essential components.
According to this file:
/usr/lib/anaconda/installclasses/rhel.py
That is located inside the mounted image of this below file:
http://mirror.centos.org/centos-6/6/os/x86_64/images/install.img
or
http://mirror.centos.org/centos-6/6/os/x86/images/install.img
* A CentOS Basic Server has : base, console-internet,
core, debugging, directory-client, hardware-monitoring,
java-platform, large-systems, network-file-system-client,
performance, perl-runtime, server-platform.
* Database Server : Basic Server (shown above), and,
mysql-client, mysql, postgresql-client, postgresql,
system-admin-tools.
* Web Server: Basic Server (shown above), and,
mysql-client, php, postgresql-client, turbogears,
web-server, web-servlet.
So below command will show what app/lib/pkg are in "Basic
Server", and should not be replaced by a 3rd party repo
packages:
yum groupinfo base core "Console internet tools"
"Directory Client" "Java Platform" "Network file system
client" "Server Platform" debugging large-systems
performance perl-runtime hardware-monitoring
--disablerepo=\* --enablerepo=base,extra,update
--disableplugin=filter-data,priorities --disableexcludes=all
in above, it is, one command-line, (text-based
email-system will break it, so remove LF/CR char to get
full command-line )
You must try to avoid replacing those, (centos essential
packages).
Copy the list in a text file, remove lines(LF/CR), make
paragraphs, and print it out or keep the text file easily
accessible location. So you can see it to decide, on 3rd
party repo which package should be placed inside "exclude".
If there is/are mistake(s) in above suggestion, please
correct.
Please post better, other way(s) to achieve these.
Thanks,
-- Bright Star.
Received from Bry8 Star, on 2013-01-28 10:16 AM:
> For PostgreSQL, i've done these (shown below) at initial/test stage:
> (pls DO NOT follow/copy it, try to understand pattern and do what
> fits for your case/need).
>
> From a VE instance inside HN:
>
> yum has these plugins: fastestmirror, filter-data, keys, list-data,
> merge-conf, presto, priorities, security, verify.
>
> # CentOS-Base.repo
> [CentOS-base]
> #<...snip...>
> enabled=1
> # i do not want below set from centos repo
> # as these exacts are released by postgre devs
> # but other postgre portions from others i do want
> exclude=postgresql.* postgresql-contrib* postgresql-debuginfo*
> postgresql-devel* postgresql-docs* postgresql-jdbc.*
> postgresql-jdbc-debuginfo* postgresql-libs* postgresql-odbc.i686
> postgresql-odbc-debuginfo* postgresql-plperl* postgresql-plpython*
> postgresql-pltcl* postgresql-server* postgresql-tcl.i686
> postgresql-tcl-debuginfo* postgresql-test*
> priority=1
>
> [CentOS-updates]
> #<...snip...>
> enabled=1
> exclude=postgresql.* postgresql-contrib* postgresql-debuginfo*
> postgresql-devel* postgresql-docs* postgresql-jdbc.*
> postgresql-jdbc-debuginfo* postgresql-libs* postgresql-odbc.i686
> postgresql-odbc-debuginfo* postgresql-plperl* postgresql-plpython*
> postgresql-pltcl* postgresql-server* postgresql-tcl.i686
> postgresql-tcl-debuginfo* postgresql-test*
> priority=1
>
> [CentOS-extras]
> #<...snip...>
> enabled=1
> exclude=postgresql.* postgresql-contrib* postgresql-debuginfo*
> postgresql-devel* postgresql-docs* postgresql-jdbc.*
> postgresql-jdbc-debuginfo* postgresql-libs* postgresql-odbc.i686
> postgresql-odbc-debuginfo* postgresql-plperl* postgresql-plpython*
> postgresql-pltcl* postgresql-server* postgresql-tcl.i686
> postgresql-tcl-debuginfo* postgresql-test*
> priority=1
>
> [CentOSplus]
> #<...snip...>
> enabled=1
> exclude=kernel.* kernel-firmware.* kernel-headers.* postgresql.*
> postgresql-contrib* postgresql-debuginfo* postgresql-devel*
> postgresql-docs* postgresql-jdbc.* postgresql-jdbc-debuginfo*
> postgresql-libs* postgresql-odbc.i686 postgresql-odbc-debuginfo*
> postgresql-plperl* postgresql-plpython* postgresql-pltcl*
> postgresql-server* postgresql-tcl.i686 postgresql-tcl-debuginfo*
> postgresql-test*
> priority=1
>
> # pgdg92-centos.repo
> [pgdg92]
> #<...snip...>
> enabled=1
> priority=10
>
> [pgdg92-source]
> #<...snip...>
> enabled=1
> priority=10
>
> #scntflnx.repo
> [SciLnx-6x-os]
> #<...snip...>
> enabled=1
> exclude=redhat-rpm-config.* postgresql.* postgresql-devel*
> postgresql-docs* postgresql-contrib* postgresql-jdbc.*
> postgresql-libs* postgresql-odbc* postgresql-plperl*
> postgresql-plpython* postgresql-pltcl* postgresql-server*
> postgresql-test*
> priority=13
>
> [SciLnx-6x-updates-fastbugs]
> #<...snip...>
> enabled=1
> exclude=postgresql.* postgresql-devel* postgresql-docs*
> postgresql-contrib* postgresql-jdbc.* postgresql-libs*
> postgresql-odbc* postgresql-plperl* postgresql-plpython*
> postgresql-pltcl* postgresql-server* postgresql-test*
> priority=13
>
> [SciLnx-6x-updates-security]
> #<...snip...>
> enabled=1
> exclude=postgresql.* postgresql-devel* postgresql-docs*
> postgresql-contrib* postgresql-jdbc.* postgresql-libs*
> postgresql-odbc* postgresql-plperl* postgresql-plpython*
> postgresql-pltcl* postgresql-server* postgresql-test*
> priority=13
>
> [SciLnx-6x-debuginfo]
> #<...snip...>
> enabled=0
> priority=13
>
> [SciLnx-6x-SRPMS]
> #<...snip...>
> enabled=1
> priority=13
>
> [pgdg92]
> #<...snip...>
> enabled=1
> priority=15
>
> ... other repo & distro ...
>
> In above way, i get most from PosteGre repo, and other postgre
> related side packages from other repos. if i were to place
> exclude=postgre* then all packages would have gotten excluded, and
> then the extra postgre pkg which are not released by postgre, would
> get hidden/excluded as well, though, i could have used this approach
> for to get that:
>
> includepkgs=related-extra-postgre-pkg
>
> to get those. but then i would need specific name, but what if new
> extra pkg that i dont know yet, is included, but since i have not
> specified specifically, those would get hidden/excluded.
> (my repo inquiries have shown, many other repo has at-least 1 to 3
> or some up to 6 extra postgre related tools which are not released
> by postgre devs themselves).
>
> Few patterns/logics which i like to follow:
>
> repo#1, rpm priority 1, srpm priority 50
> repo#2, rpm priority 10, srpm priority 40
> repo#3, rpm priority 15, srpm priority 30
> repo#4, rpm priority 20, srpm priority 20
> ...
>
> Priority numbering pattern/logic:
> Since i'm using centos as my base,
> so various DISTRO & REPO rpm/binary which
> are closest to CentOS & CentOS's source RHEL,
> those distro & repo will get lowest priority#
> close to centos.
> i like to think/visualize in this way ...
> a LIST from top to down, now number them
> from top to bottom 1, 2, 3.. CentOS is at
> position 1, the top-most position.
> The lowest priority number, is at highest,
> upper position in the list, is chosen first
> by yum/installer, and has highest priority,
> if it(yum) wants to install something.
>
> my knol is this (i could be wrong):
> RHEL based source ->
> |-> CentOS base.
> |-> Scientific Linux.
> |-> Oracle Linux.
> |-> ClearOS Linux.
>
> (Fedora stable source -> RHEL -> RHEL source).
>
> EPEL has extra small tools/apps/libs for
> RHEL base apps/libs, and also for RHEL
> based clone/derivative distros (few
> mentioned above).
> RPMforge/dag has many perl related stuff.
> REMI has latest+stable PHP, MySql related stuff.
> ELrepo is for hardware latest+stable drivers, kernels.
> kdeRedhat is mostly for latest+stable KDE, QT, samba, etc.
> RPMFusion has closed-source-free, open-source-free, non-free etc apps.
> ATrpms has MythTV, Scientific Apps, etc.
> LnxTechNet has audio,video,etc apps.
>
> And Fedora 17, 18 source/src/SRPMS are needed to be re-built on
> cnetos for those apps/libs, then those can be used with centos.
>
> Pkg "Excluding" pattern/logic:
> (means, Getting specific pkg from
> Non-Centos repo):
> Now for example if i want something specific
> called "pkg-set-3" from repo#3, then i would have
> to place those specific pkgs inside the "exclude"
> line in repo(s) which are listed at upper position
> on the repo-list, so that will be repo#2, repo#1,
> so it will be:
> # repo_1.repo file inside /etc/yum.repos.d
> [repo_1]
> exclude=pkg-set-3
>
> # repo_2.repo file inside /etc/yum.repos.d
> [repo_2]
> exclude=pkg-set-3
> # in 'exclude' pkgs are 'space' separated
>
> Where & How to tweak & apply intelligence/knowledge
> and experience and tricks , etc for repo-config ?
> i like to call it HI (Human Intelligence),
> multiple (or one) developer's initial
> HI becomes AI in a software.
>
> Each repo file will most likely have
> one or more section/channel like below:
> [section-or-channel-name]
> config_options=values
> ...
>
> in repo#2, the "pkg-set-3" can be placed inside
> all section/channel of that repo file.
>
> For setting repo#1 (in our case, this is centos),
> we will have to do these:
>
> set "enabled=" to 0 in all new repo,
> (except centos.repo),
> or, by using yum command-line options
> instruct "yum" to disable all repo,
> then instruct yum to enable only
> centos-base,centos-updates, etc repo only
> and then do "yum check-update", like this:
>
> yum --disablerepo=\* --enablerepo=base,update,centosplus,extra
> check-update
>
> ... above command will show if centos repo has new updates (or no
> updates) for your system.
>
> then set enabled=1 in those section/channel which you need for the
> app/lib (pk-set-3) which you wanted.
>
> then run do "yum check-update".
> ... It will show list of app/lib which will be updated if you were
> to run "yum update" or "yum upgrade".
>
> Also see other helpful yum commands.
>
> Since these yum commands will show app/lib name and which repo has
> it, observe carefully and make a hand-written list first (or write
> on a text file on the client computer from where you're connecting
> to your centos server which you are trying to configure), a list,
> apps/libs which you need to exclude from which repo.
>
> Other helpful YUM COMMANDS:
>
> yum list updates '*' --disableplugin=filter-data,priorities
> --disableexcludes=all
>
> ... should show what updates will be in queue if all "excludes" are
> ignored.
>
> yum list all available 'pkg-name*'
> --disableplugin=filter-data,priorities --disableexcludes=all
>
> ... should show which of your repos has any package that are close
> to the name "pkg-name" and will also show their version # and what
> repo has it.
>
> Anytime you change any "somename.repo" file,
> then its better to do first:
> yum check-update
> (but do not update, unless you are sure which app is coming from
> which exact repo and if that is what you want or not).
>
> Please ADD/POST MORE/YOUR HELPFUL COMMANDS,
> and tell us what it does, where useful.
>
> Since source/SRPMS is/are needed when you/i need to make src.rpm, so
> distro & repo closest to CentOS gets higher priority, usually that
> is in reverse order than the RPM/binaries.
>
> Please correct my mistakes and add your responses, ideas,
> suggestions, logics, patterns, etc.
>
> Thanks in advance,
>
> -- Bright Star.
>
>
>
> Received from Johnny Hughes,, on 2013-01-28 12:50 AM:
>> On 01/27/2013 06:20 PM, Rob Kampen wrote:
>>> On 01/28/2013 04:43 AM, Mark LaPierre wrote:
>>>> On 01/27/2013 08:18 AM, Bry8 Star wrote:
>>>>> Hi Anthony, it would be really great, to see various types
>>>>> of repo-configs on centos wiki, now if few helpful&
>>>>> experienced users can grab this idea and come forward and
>>>>> share their repo config (and their case/usage scenario
>>>>> along with that), then that would be great.
>>>>>
>>>>> <snip>
>>>>>
>>>>> (Sorry for spelling& grammar mistakes in previous and in
>>>>> this posting, pls kindly disregard, its not a grammar
>>>>> discussion thread).
>>>>>
>>>>> -- Bry8Star.
>>>>>
>>>>>
>>>>>
>>>>> Received from Anthony K, on 2013-01-27 2:48 AM:
>>>>>> On 26/01/13 14:59, Bry8 Star wrote:
>>>>>>> CentOS webpage/site should also show to all users, some
>>>>>>> example of using multiple repos and how to implement
>>>>>>> effective includepkgs, exclude, priority etc directives
>>>>>>> properly for some certain last& STABLE app(s) (which
>>>>>>> is by default not in CentOS), so that others can
>>>>>>> understand the pattern, or have a pointer for them.
>>>>>>> Just mentioning about, that, there is such things
>>>>>>> called "includepkgs=...", "exclude=..." ad now go do
>>>>>>> it yourself (and sorry no example), obviously does not
>>>>>>> help that much to users, and its CentOS's loss as well,
>>>>>>> users go away to other distros, and ultimately many of
>>>>>>> them are lost in the jungle. -- Bright Star
>>>>>>> (Bry8Star).
>>>>>> But you appear to be missing the "C" part in CentOS (or
>>>>>> Community Enterprise OS). If you can contribute to the
>>>>>> Wiki, then the immediate problem is solved in that such
>>>>>> threads can be pointed to the Wiki and slows the growth
>>>>>> of my CentOS list folder!
>>>>>>
>>>>>> Frankly, if you have a good point to make that would
>>>>>> benefit the masses and you have spare time, then it's
>>>>>> best to create a Wiki page for it.
>>>>>>
>>>>>> Cheers, ak.
>>>>>>
>>>> There is already a fine page on this subject on the wiki.
>>>>
>>>> http://wiki.centos.org/AdditionalResources/Repositories
>>>>
>>> The point being made is that various people have the knowledge
>>> and experience to advise a startup setting for priority= for
>>> each repo I know that what I'm using has caused conflicts that
>>> have been quite time consuming to resolve - what works for
>>> others would be most helpful I do recognise that this will vary
>>> depending upon what tools are required but as a start: 1.
>>> developer workstation - what repos and what priority 2. LAMP
>>> server - probably just CentOS repos and something which deals
>>> with later php / perl / ruby 3. web / internet workstation -
>>> needs audio and video stuff working just my thoughts for
>>> starters.
>>
>> That totally depends on what you need to install and what repo it
>> is in. Since 3rd party repos are constantly adding new packages
>> that they did not have last week, it is impossible to say what
>> would be the proper priorities.
>>
>> I already posted what I personally do, which is:
>>
>> Install CentOS and set Base, updates, extras, and fasttrack to a
>> Priority=1
>>
>> I usually do not need to enable centosplus, but if I do, I set it
>> to Priority=2 and I put "excludes=<pkg_names>" in the Priority=1
>> repos for the packages I want let CentOS plus replace in those
>> repos.
>>
>> I then normally add EPEL and set the Priority=10 for that.
>>
>> Hopefully, that is all I need to add.
>>
>> If I have to add any more repositories, first make sure my
>> packages are currently all updated by doing a yum upgrade. Then
>> I add the new repos one at a time and I make them Priority=10
>> (the same as EPEL) ... and after I add them , i do a "yum
>> update". If it tries to update, I look at the packages and
>> decide if I am going to allow the update or not ... if I am ok to
>> do the updates, then I do them and make sure it works. Then I
>> would install the packages I need from that repo. Then I would
>> add the next new repo till I get to the end.
>>
>> The best scenario is that all your 3rd party repos can co-exist
>> at the same Priority setting and that is where I start (at
>> Priority=10) ... and if something does not work, I troubleshoot
>> it and take individual action.
>>
>> Each individual machine is going to require a unique and separate
>> group of settings based on what you want to install ... which is
>> why there is no official recommendations.
>>
>> I personally am using the following repos right now on my main
>> Desktop, which is CentOS-6.3:
>>
>> adobe-linux-x86_64
>> | 951 B 00:00 base
>> | 3.7 kB 00:00 cr
>> | 3.0 kB 00:00 elrepo
>> | 1.9 kB 00:00 elrepo-extras
>> | 1.9 kB 00:00 extras
>> | 3.5 kB 00:00 fasttrack
>> | 3.5 kB 00:00 google-chrome
>> | 951 B 00:00 google-musicmanager
>> | 951 B 00:00 livna
>> | 1.3 kB 00:00 nux-dextop
>> | 2.7 kB 00:00 rpmforge
>> | 1.9 kB 00:00 updates
>> | 3.5 kB 00:00
>>
>> All of the secondary repos are set to the same priorities and
>> everything seems to work.
>>
>> Right now I have an "exclude=wxGtk*" for rpmforge for some
>> reason. And an "exclude=nx freenx*" for Nux! repo.
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> CentOS mailing
>> list CentOS(a)centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>>
>
>
>
> _______________________________________________
> CentOS mailing list
> CentOS(a)centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
Could you be a little bit more specific, what are those needs..?
/ Nicco
On 10/13/07, Ross S. W. Walker <rwalker(a)medallion.com> wrote:
>
> Not if one intends to modify it to suite racoon's specific needs...
>
> -Ross
>
>
> > -----Original Message-----
> > From: Nicolas Sahlqvist [mailto:nicco77@gmail.com]
> > Sent: Friday, October 12, 2007 8:04 PM
> > To: CentOS mailing list; Ross S. W. Walker
> > Subject: Re: [CentOS] OT: a very big problem with ipsec-tools
> > on CentOS5 (SOLVED)
> >
> > Does it not more sense to make a symlink rather then copying
> > the file..?
> >
> >
> > / Nicolas
> >
> > On 10/13/07, carlopmart <carlopmart(a)gmail.com> wrote:
> > > Buf ... Solved. Problem was that /etc/pam.d/racoon doesn't
> > exists (I found
> > > this
> > > tip on NetBSD ipsec pages). Simply I have copied
> > /etc/pam.d/passwd to
> > > /etc/pam.d/racoon and now all works as expected.
> > >
> > > Many thanks for your help Ross.
> > >
> > >
> > >
> > > Ross S. W. Walker wrote:
> > > >
> > > > I think it might just use another one like /etc/pam.d/remote
> > > > cause I audited the package and it wasn't there.
> > > >
> > > > Does the "users" group exist and charlie a member of it?
> > > >
> > > > -Ross
> > > >
> > > >> -----Original Message-----
> > > >> From: carlopmart [mailto:carlopmart@gmail.com]
> > > >> Sent: Friday, October 12, 2007 6:54 PM
> > > >> To: Ross S. W. Walker
> > > >> Subject: Re: [CentOS] OT: a very big problem with ipsec-tools
> > > >> on CentOS5
> > > >>
> > > >> hi ross,
> > > >>
> > > >> Yes I compiled with pam option. But I don't have any ipsec
> > > >> config file on
> > > >> /etc/pam.d ... I didn't find any sample on ipsec-tools 0.7
> > > >> source tree ... where
> > > >> is it??
> > > >>
> > > >> Ross S. W. Walker wrote:
> > > >>> If you compiled ipsec tools yourself did you compile with
> > > >> the pam option?
> > > >>> If not then you can't tell it to use pam for authentication.
> > > >>>
> > > >>> If you did, did you setup the appropriate ipsec config file in
> > > >>> /etc/pam.d? I believe there is an example one in the ipsec
> > > >> source tree.
> > > >>> -Ross
> > > >>>
> > > >>>
> > > >>> -----Original Message-----
> > > >>> From: centos-bounces(a)centos.org <centos-bounces(a)centos.org>
> > > >>> To: centos(a)centos.org <centos(a)centos.org>
> > > >>> Sent: Fri Oct 12 18:38:38 2007
> > > >>> Subject: [CentOS] OT: a very big problem with
> > ipsec-tools on CentOS5
> > > >>>
> > > >>> Hi all,
> > > >>>
> > > >>> I am trying to establish a vpn tunnel between one CentOS5
> > > >> IPSec server
> > > >>> and a
> > > >>> roadwarrior client, CentOS5 too. Roadwarrior use
> > > >> ipsec-tools version 0.6.5-8
> > > >>> (that comes with CentOS5) and server uses version 0.7
> > > >> (downloaded from
> > > >>> ipsec-tools website).
> > > >>>
> > > >>> My server configuration is:
> > > >>>
> > > >>> path include "/etc/racoon";
> > > >>> path certificate "/etc/racoon/certs";
> > > >>> path pre_shared_key "/etc/racoon/psk.txt";
> > > >>> path pidfile "/var/run/racoon.pid";
> > > >>> #log debug;
> > > >>>
> > > >>> listen {
> > > >>> adminsock "/var/racoon/racoon.sock" "root"
> > "nobody" 0660;
> > > >>> isakmp 172.28.45.4 [500];
> > > >>> isakmp_natt 172.28.45.4 [4500];
> > > >>> }
> > > >>>
> > > >>> remote anonymous {
> > > >>> exchange_mode aggressive;
> > > >>> certificate_type x509 "gwenc.crt" "gwenc.key";
> > > >>> my_identifier asn1dn;
> > > >>> proposal_check claim;
> > > >>> generate_policy on;
> > > >>> nat_traversal on;
> > > >>> dpd_delay 20;
> > > >>> ike_frag on;
> > > >>> passive on;
> > > >>> proposal {
> > > >>> encryption_algorithm aes;
> > > >>> hash_algorithm sha256;
> > > >>> authentication_method hybrid_rsa_server;
> > > >>> dh_group 2;
> > > >>> }
> > > >>> }
> > > >>>
> > > >>> mode_cfg {
> > > >>> network4 172.31.78.5;
> > > >>> netmask4 255.255.255.240;
> > > >>> pool_size 6;
> > > >>> dns4 172.25.50.1;
> > > >>> auth_source pam;
> > > >>> auth_groups "users";
> > > >>> group_source system;
> > > >>> auth_throttle 10;
> > > >>> pfs_group 2;
> > > >>> }
> > > >>>
> > > >>> sainfo anonymous
> > > >>> {
> > > >>> pfs_group 2;
> > > >>> lifetime time 1 hour;
> > > >>> encryption_algorithm rijndael;
> > > >>> authentication_algorithm hmac_sha256;
> > > >>> compression_algorithm deflate;
> > > >>> }
> > > >>>
> > > >>> When I try to connect from roadwarrior client using
> > xauth, server
> > > >>> returns me
> > > >>> this errors:
> > > >>>
> > > >>> 2007-10-13 00:21:52: INFO: ISAKMP-SA established
> > > >>> 172.28.45.4[4500]-172.17.35.3[4500]
> > > >> spi:e3ff2f5a0873ff54:ad9b13f8035ec2f2
> > > >>> 2007-10-13 00:21:52: INFO: Using port 0
> > > >>> 2007-10-13 00:21:52: ERROR: pam_authenticate failed:
> > > >> Authentication failure
> > > >>> 2007-10-13 00:21:52: INFO: Released port 0
> > > >>> 2007-10-13 00:21:52: INFO: login failed for user "charlie"
> > > >>> 2007-10-13 00:21:52: ERROR: Attempt to release an
> > > >> unallocated address
> > > >>> (port 0)
> > > >>> 2007-10-13 00:21:52: ERROR: mode config 6 from
> > > >> 172.17.35.3[4500], but we
> > > >>> have no
> > > >>> ISAKMP-SA.
> > > >>> 2007-10-13 00:21:52: ERROR: unknown Informational
> > exchange received.
> > > >>>
> > > >>> why? I don't understand. Well, yes, I think that server
> > > >> doesn't use
> > > >>> really pam
> > > >>> libraries or problem is that linux use shadow for
> > passwords instead
> > > >>> passwd file.
> > > >>>
> > > >>>
> > > >>> I see a lot of webs on this configuration works out of
> > > >> the box, but
> > > >>> not for
> > > >>> me.... I am really desperated.
> > > >>>
> > > >>> Many thanks.
> > > >>>
> > > >>> P.D: On ipsec-tools mailing list i don't receive any response.
> > > >>> --
> > > >>> CL Martinez
> > > >>> carlopmart {at} gmail {d0t} com
> > > >>> _______________________________________________
> > > >>> CentOS mailing list
> > > >>> CentOS(a)centos.org
> > > >>> http://lists.centos.org/mailman/listinfo/centos
> > > >>>
> > > >>>
> > > >> --------------------------------------------------------------
> > > >> ----------
> > > >>> This e-mail, and any attachments thereto, is intended only
> > > >> for use by
> > > >>> the addressee(s) named herein and may contain legally
> > > >> privileged and/or
> > > >>> confidential information. If you are not the intended
> > > >> recipient of this
> > > >>> e-mail, you are hereby notified that any dissemination,
> > > >> distribution or
> > > >>> copying of this e-mail, and any attachments thereto, is strictly
> > > >>> prohibited. If you have received this e-mail in error, please
> > > >>> immediately notify the sender and permanently delete the
> > > >> original and
> > > >>> any copy or printout thereof.
> > > >>
> > > >> --
> > > >> CL Martinez
> > > >> carlopmart {at} gmail {d0t} com
> > > >>
> > > >
> > > >
> > ______________________________________________________________________
> > > > This e-mail, and any attachments thereto, is intended
> > only for use by
> > > > the addressee(s) named herein and may contain legally privileged
> > > > and/or confidential information. If you are not the
> > intended recipient
> > > > of this e-mail, you are hereby notified that any dissemination,
> > > > distribution or copying of this e-mail, and any
> > attachments thereto,
> > > > is strictly prohibited. If you have received this e-mail in error,
> > > > please immediately notify the sender and permanently delete the
> > > > original and any copy or printout thereof.
> > > >
> > > >
> > >
> > >
> > > --
> > > CL Martinez
> > > carlopmart {at} gmail {d0t} com
> > > _______________________________________________
> > > CentOS mailing list
> > > CentOS(a)centos.org
> > > http://lists.centos.org/mailman/listinfo/centos
> > >
> >
>
> ______________________________________________________________________
> This e-mail, and any attachments thereto, is intended only for use by
> the addressee(s) named herein and may contain legally privileged
> and/or confidential information. If you are not the intended recipient
> of this e-mail, you are hereby notified that any dissemination,
> distribution or copying of this e-mail, and any attachments thereto,
> is strictly prohibited. If you have received this e-mail in error,
> please immediately notify the sender and permanently delete the
> original and any copy or printout thereof.
>
>
On Mon, Dec 29, 2014 at 8:04 PM, Warren Young <wyml(a)etr-usa.com> wrote:
> >>>
>>> the world where you design, build, and deploy The System is disappearing fast.
>>
>> Sure, if you don't care if you lose data, you can skip those steps.
>
> How did you jump from incremental feature roll-outs to data loss? There is no necessary connection there.
No, it's not necessary for either code interfaces or data structures
to change in backward-incompatible ways. But the people who push one
kind of change aren't likely to care about the other either.
> In fact, I’d say you have a bigger risk of data loss when moving between two systems released years apart than two systems released a month apart. That’s a huge software market in its own right: legacy data conversion.
I'm not really arguing about the timing of changes, I'm concerned
about the cost of unnecessary user interface changes, code interface
breakage, and data incompatibility, regardless of when it happens.
RHEL's reason for existence is that it mostly shields users from that
within a major release. That doesn't make it better when it happens
when you are forced to move to the next one.
> If your software is DBMS-backed and a new feature changes the schema, you can use one of the many available systems for managing schema versions. Or, roll your own; it isn’t hard.
Are you offering to do it for free?
> You test before rolling something to production, and you run backups so that if all else fails, you can roll back to the prior version.
That's fine if you have one machine and can afford to shut down while
you make something work. Most businesses aren't like that.
> None of this is revolutionary. It’s just what you do, every day.
And it is time consuming and expensive.
>> when it breaks it's not the developer answering
>> the phones if anyone answers at all.
>
> Tech support calls shouldn’t go straight to the developers under any development model, short of sole proprietorship, and not even then, if you can get away with it. There needs to be at least one layer of buffering in there: train up the secretary to some basic level of cluefulness, do everything via email, or even hire some dedicated support staff.
>
> It simply costs too much to break a developer out of flow to allow a customer to ring a bell on a developer’s desk at will.
Beg your pardon? How about not breaking the things that trigger the
calls in the first place - or taking some responsibility for it. Do
you think other people have nothing better to do?
> Since we’re contrasting with waterfall development processes that may last many years, but not decades, I’d say the error has already been made if you’re still working with a waterfall-based methodology today.
>
We never change more than half of a load-balenced set of servers at
once. So all changes have to be compatible when running concurrently,
or worth rolling out a whole replacement farm.
>> some stuff can't be.
>
> Very little software must be developed in waterfall fashion.
If you run continuous services you either have to be able to run
new/old concurrently or completely duplicate your server farm as you
roll out incompatible clients.
> Last time I checked, this sort of software only accounted for about ~5% of all software produced, and that fraction is likely dropping, with the moves toward cloud services, open source software, subscription software, and subsidized software.
>
> The vast majority of software developed is in-house stuff, where the developers and the users *can* enter into an agile delivery cycle.
OK, but they have to not break existing interfaces when they do that.
And that's not the case with OS upgrades.
>> If you are, say, adding up dollars, how many times do you want that
>> functionality to change?
>
> I’m not sure what you’re asking.
I'm asking if computer science has advanced to the point where adding
up a total needs new functionality, or if you would like the same
total for the same numbers that you would have gotten last year. Or
more to the point, if the same program ran correctly last year,
wouldn't it be nice if it still ran the same way this year, in spite
of the OS upgrade you need to do because of the security bugs that
keep getting shipped while developers spend their time making
arbitrary changes to user interfaces.
> Compare a rolling release model like that of Cygwin or Ubuntu (not LTS). Something might break every few months, which sounds bad until you consider that the alternative is for *everything* to break at the same time, every 3-7 years.
When your system requires extensive testing, the few times it breaks
the better. Never would be nice...
>>> I don’t mean that glibly. I mean you have made a fundamental mistake if your system breaks badly enough due to an OS change that you can’t fix it within an iteration or two of your normal development process. The most likely mistake is staffing your team entirely with people who have never been through a platform shift before.
>>
>> Please quantify that. How much should a business expect to spend per
>> person to re-train their operations staff to keep their systems
>> working across a required OS update? Not to add functionality. To
>> keep something that was working running the way it was?
>
> If you hire competent people, you pay zero extra to do this, because this is the job they have been hired to do.
That's nonsense for any complex system. There are always _many_
different OS versions in play and many different development groups
that only understand a subset, and every new change they need to know
about costs time and risks mistakes.
> That's pretty much what IT/custom development is: coping with churn.
And it is expensive. Unnecessarily so, in my opinion.
>> How many customers for your service did you keep running non-stop
>> across those transitions?
>
> Most of our customers are K-12 schools, so we’re not talking about a 24/7 system to begin with. K-12 runs maybe 9 hours a day (7am - 4pm), 5 days a week, 9 months out of the year. That gives us many upgrade windows.
That's a very different scenario than a farm of data servers that have
to be available 24/7.
> We rarely change out hardware or the OS at a particular site. We generally run it until it falls over, dead.
>
> This means we’re still building binaries for EL3.
I have a few of those, but I don't believe that is a sane thing to recommend.
> This also means our software must *remain* broadly portable. When we talk about porting to EL7, we don’t mean that it stops working on EL6 and earlier. We might have some graceful feature degradation where the older OS simply can’t do something the newer one can, but we don’t just chop off an old OS because a new one came out.
>
You'd probably be better off in java if you aren't already.
>>> Everyone’s moaning about systemd...at least it’s looking to be a real de facto standard going forward.
>>
>> What you expect to pay to re-train operations staff -just- for this
>> change, -just- to keep things working the same..
>
> You ask that as if you think you have a no-cost option in the question of how to address the churn.
I ask it as if I think that software developers could make changes
without breaking existing interfaces. And yes, I do think they could
if they cared about anyone who built on those interfaces.
>> We've got lots of stuff that will drop into Windows server versions
>> spanning well over a 10 year range.
>
> Yes, well, Linux has always had a problem with ABI stability. Apparently the industry doesn’t really care about this, evidenced by the fizzling of LSB, and the current attacks on the work at freedesktop.org. Apparently we’d all rather be fractious than learn to get along well enough that we can nail down some real standards.
Well, that has done a great job of keeping Microsoft in business.
> I’ve never done much with Windows Server, but my sense is that they have plenty of churn over in their world, too. We’ve got SELinux and SystemD, they’ve got UAC, SxS DLLs, API deprecation, and tools that shuffle positions on every release. (Where did they move the IPv4 configuration dialog this time?!)
>
> We get worked up here about things like the loss of 32-bit support, but over in MS land, they get API-of-the-year. JET, ODBC, OLE DB, or ADO? Win32, .NET desktop, Silverlight, or Metro? GDI, WinG, DirectX, Windows Forms or XAML? On and on, and that’s just if you stay within the MSDN walls.
Yes, there are changes - and sometimes mysterious breakage. But an
outright abandonment of an existing interface that breaks previously
working code s pretty rare (and I don't like it when they do it
either...).
>> Were you paying attention when Microsoft wanted to make XP obsolete?
>> There is a lot of it still running.
>
> Were you paying attention when Target’s XP-based POS terminals all got pwned?
>
> Stability and compatibility are not universal goods.
Well, some things you have to get right in the first place - and then
stability is good.
> Google already did that cost/benefit calculation: they tried staying on RH 7.1 indefinitely, and thereby built up 10 years of technical debt. Then when they did jump, it was a major undertaking, though one they apparently felt was worth doing.
And conversely, they felt is was worth _not_ doing for a very very
long time. So can the rest of us wait until we have google's
resources?
>> And why do you think it is a good thing
>> for this to be a hard problem or for every individual user to be
>> forced to solve it himself?
>
> I never said it was a good thing. I’m just reporting some observations from the field.
Maybe I misunderstood - I thought you were defending the status quo -
and the fedora developers that bring it to us.
--
Les Mikesell
lesmikesell(a)gmail.com