Bug 614392

Summary:	glsa 201701-75: Wrong instruction on how to update dev-lang/perl.
Product:	Gentoo Security	Reporter:	Teika kazura <teika>
Component:	GLSA Errors	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kentnl
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Teika kazura 2017-04-01 05:35:10 UTC

Glsa 201701-75 asks users to update Perl by:
 $ emerge -1av ">=dev-lang/perl-5.22.3_rc4"
According to Dilfridge[1], the "correct" way to upgrade (the major version of) Perl is:
 $ emerge -uDNav --backtrack 1000 world
(If you have to specify backtrack manually, then it must be a portage bug, though.) At least, the GLSA's instruction failed for me, even with --backtrack=30.

It seems that glsa always uses "--oneshot <package>", but maybe that habit has to be changed for Perl.

@Dilfridge: Thanks a lot for revising the Wiki page. I'm the person who created that page.

Thanks Gentoo developers. Best regards.

[1]
https://wiki.gentoo.org/wiki/Perl
https://wiki.gentoo.org/index.php?title=Perl&diff=628792&oldid=627682


Reproducible: Always

Comment 1 Kent Fredric (IRC: kent\n) (RETIRED) gentoo-dev

2017-04-01 05:54:26 UTC

I'm not sure it qualifies as "Incorrect".

The problem is portage does the wrong thing, even with the "most correct" invocation there is.

Subsequently, there is no single "correct" approach, just a collection of different approaches for different problems.

For instance, recently, it took a full day of supporting a user in #gentoo in order to coerce their system into doing the right thing.

I know this isn't great, but we're ultimately limited by what portage lets us do, and the complexities involved with user-choice makes even the most ideal instructions fail.

Comment 2 Teika kazura 2017-04-08 13:15:50 UTC

Maybe I was ambigous. Ideal solutions have to be sought, but it's, in practice, unfeasible right now. I don't know how to set up the goal properly.

Yet, something practical is necessary, so that users won't be left at loss. Actually I was. (That's what caused me to create the wiki page "Perl")

How about mentioning that Wiki page? You (kentnl) and Dilfrige have seen and revised it, and it describes several ways to cope with subslot conflict. Though Wiki has no guarantee of the contents stability, a specific revision can be linked to. I know GLSA is official, and it's better to avoid hacks, and should be definitive. However the solution *has to be* effective.

There must be some good idea. ;)

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2017-06-01 01:20:05 UTC

Thanks for the report. I updated the GLSA to address your concerns: https://gitweb.gentoo.org/data/glsa.git/commit/?id=c0ee40ad4dc5c96ebf25659e3374fc38f9a5a4a2