ubuntu-devel Digest, Vol 24, Issue 37

[Adam Weiss]

> > I'm wondering if this means that the delay time from busted package fix to
> > actual install is not just two hours for the replication, but actually 24
> > in cases where the package db is updated by the daily cronjob with a
> > bad package and the user doesn't actually click the "Check" button.
>
> No; you only encountered this situation because you rolled back to an old
> version of the package rather than forward to the fixed version.  The update
> system will never replace a newer package from the official repositories
> with an older one.

I don't think I explained this right...  I started with the base revision
(10), updated to the broken one (10.3), then rolled back to the base
revision (10).  When I logged in as rolled back to the base revision, I
got an update notification showing that an update to 10.3 (broken) was
available.  It wasn't until I clicked "Check" that it noticed that 10.4
(fixed) was available.

Hypothetical situation: Broken package is released at 18:00 UTC on Monday,
many machines automatically update the package list at ~03:00 UTC on
Tuesday morning.  Developer notices, fixes critical bug and publishes the
fixed package to the repositories at 09:00 UTC on Tuesday.  Does this mean
that the users that automatically updated at 03:00 UTC on Tuesday morning
won't see the fixed package until sometime after 03:00 UTC on Wednesday
unless they click the "Check"  button.  (therefore opening up all of
Tuesday for exposure to the bad package despite the fact that the package
was fixed Tuesday morning?)

> Package downgrades are, in general, unsupportable and to be avoided, so this
> would not be a good default.  It is better to install a fixed version
> wherever possible.

Perhaps in the case of the X server it might be worth creating a package
for a barebones vesa X server (with separate binaries and everything
located in a separate root) for a "recovery shell" of sorts that can be
offered when X fails to start.  But that does sound like a lot of work and
could be messy...

--adam