Bug 624079 - Additions to updateinfo xml repodata
Summary: Additions to updateinfo xml repodata
Alias: None
Product: Fedora
Classification: Fedora
Component: yum
Version: 19
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Packaging Maintenance Team
QA Contact: Fedora Extras Quality Assurance
Depends On:
Blocks: 624086
TreeView+ depends on / blocked
Reported: 2010-08-13 15:17 UTC by Mark J. Cox
Modified: 2014-10-03 12:49 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-10-03 12:49:51 UTC

Attachments (Terms of Use)
Proposed patch (3.88 KB, patch)
2010-08-13 15:17 UTC, Mark J. Cox
no flags Details | Diff

Description Mark J. Cox 2010-08-13 15:17:37 UTC
Created attachment 438697 [details]
Proposed patch

In order to support future products we need to be able to deal with extra fields in the updateinfo repodata.

Testing of current updatinfo consumers (yum security plugin, pup, PackageKit) show they are lenient in parsing and will ignore any of these extra fields if present.

The attached patch (untested) adds 

severity:  For Red Hat errata we provide a single severity rating per update,
"critical", "important", "moderate", or "low".  If this had it's own
field then a consumer of this file could select issues based on
severity, sort by severity, or other useful functions.  The
severity is also mentioned in the summary and in the topic line, but
none of these are displayed by current consumers.

Missing description pieces: At the moment RHN only puts part of the errata details into 'description', leaving out the summary and solution text.  While we
could get RHN to include these in the description field they create, some of this data is perhaps not important when looking at a GUI display of things you need to update.  So we add <summary> and <solution> entities

rights:  Provide a 'rights' entity so any advisory built from the data
in the 'updateinfo' file can state any legal or other rights
notices required.

(and we also note that type="other" is a valid reference type)

Comment 1 James Antill 2010-08-16 19:20:55 UTC
Thanks, just about to check this in. One minor nit though, you copied the code for description by doing:

+            'rights'           : '',
+        if self._md['rights'] is not None:
+            desc = utf8_text_wrap(self._md['rights'], width=64,
+                                  subsequent_indent=' ' * 12 + ': ')
+            head += "     Rights : %s\n" % '\n'.join(desc)

...which is a bug, as '' != None so it'll always show. (description "must" be present, which is why nobody has fixed it there).

 I changed the test to:

+        if self._md['rights']:

...if you want to go the other way, shout.

Comment 2 Mark J. Cox 2010-08-17 07:40:34 UTC
Good catch, thanks.

Comment 4 Mark J. Cox 2010-09-15 10:27:53 UTC
Looks like I missed 'severity' from my patch, but it is in the new updateinfo.xml

For an abstract for testing, see 
Abstract of RHN x86_64-client-5 updateinfo.xml as of Sept 15 2010

Please could you add 'severity' (should look almost identical to the code for 'rights').  Thanks

Comment 5 James Antill 2010-09-15 12:31:32 UTC
Posted for upstream ACK.
And thanks for the updateinfo.xml :).

Comment 6 James Antill 2010-11-04 17:12:35 UTC
Ok, I've finally got around to doing all the client stuff for this in the security plugin.

A couple of questions:

1. Do you want rights displayed by default? (I'm guessing it's going to be the same for all of them, but it's only one line...)

2. Do you want summary/solution displayed by default (seem big and useless, but meh).

3. Atm. I assume that severity is tied to security ... so the option is called --sec-severity, and so with --sec-severity=Critical the --security option does mostly nothing.

4. For "updateinfo list security" I'm doing:

FEDORA-2010-16593 security      xulrunner-
FEDORA-2010-16883 Critical/Sec. xulrunner-

...where I've altered 16883 to have severity=critical (both are security). I assume this is fine?

5. For "updateinfo summary security" I'm doing:

    11 Security notice(s)
        10 ? Security notice(s)
         1 Critical Security notice(s)

...and if they were call Critical it'd be:

    11 Critical Security notice(s)

...again, I ignore any severity data for bugfix/etc. ... I assume this is fine?

Comment 7 Mark J. Cox 2010-11-05 11:17:34 UTC
1 - no, i we don't need to do this
2 - no, let's not do this either.  If they are using yum security then the solution boilerplate isn't much use.
3 - ok
4 - ok
5 - ok

Comment 8 Fedora End Of Life 2013-04-03 19:03:34 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:

Note You need to log in before you can comment on or make changes to this bug.