From owner-freebsd-ports@FreeBSD.ORG Thu Apr 3 19:55:35 2014 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 03EE5C04 for ; Thu, 3 Apr 2014 19:55:35 +0000 (UTC) Received: from shepard.synsport.net (mail.synsport.com [208.69.230.148]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id CE211856 for ; Thu, 3 Apr 2014 19:55:33 +0000 (UTC) Received: from [192.168.0.20] (unknown [130.255.19.191]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by shepard.synsport.net (Postfix) with ESMTP id B6C0643B4E; Thu, 3 Apr 2014 14:55:10 -0500 (CDT) Message-ID: <533DBC8C.9040400@marino.st> Date: Thu, 03 Apr 2014 21:54:52 +0200 From: John Marino User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: freebsd-ports@freebsd.org, j.david.lists@gmail.com Subject: Re: Updating less-than-everything with poudriere & pkgng References: <91FF893BBE05EEFA2894EED9@atuin.in.mat.cc> <891ACB1137F7FAFFFFAF9A3A@ogg.in.absolight.net> In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: marino@freebsd.org List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Apr 2014 19:55:35 -0000 On 4/3/2014 19:52, J David wrote: > > The net effect of all of this is that even if you do take 24 hours and > rebuild all the ports that depend on perl because of that foobar > vulnerability, including bazqux, you *still* end up pissing off the > bazqux users because it rev'd bazqux from 1.5 to 2.0 and 2.0 isn't > backward compatible. And the people using bazqux don't take "well > foobar had a security issue" as a reason for disrupting them, because > they don't care one whit about foobar. You've been throwing out this 8000 packages = 24 hours bit for a couple of days now. Our setup builds packages at an average rate of 600 packages an hour, ranging from 100 to 1600 pkg/hour impulse, and that is counting the monster-size packages. If you are really serious about all these requirements, get a better build machine. You could probably build 8000 packages with a single machine in 10 hours or less depending on the actual packages (e.g. if they are mostly perl packages it could be faster) I don't think anybody is going to reprogram the logic of poudriere though. This is just an academic discussion of what could be done, but I doubt anybody wants to actually implement it due to the potential side effects (and the (limited) gain vs the implementation cost). John