Created attachment 438697 [details]
In order to support future products we need to be able to deal with extra fields in the updateinfo repodata.
Testing of current updatinfo consumers (yum security plugin, pup, PackageKit) show they are lenient in parsing and will ignore any of these extra fields if present.
The attached patch (untested) adds
severity: For Red Hat errata we provide a single severity rating per update,
"critical", "important", "moderate", or "low". If this had it's own
field then a consumer of this file could select issues based on
severity, sort by severity, or other useful functions. The
severity is also mentioned in the summary and in the topic line, but
none of these are displayed by current consumers.
Missing description pieces: At the moment RHN only puts part of the errata details into 'description', leaving out the summary and solution text. While we
could get RHN to include these in the description field they create, some of this data is perhaps not important when looking at a GUI display of things you need to update. So we add <summary> and <solution> entities
rights: Provide a 'rights' entity so any advisory built from the data
in the 'updateinfo' file can state any legal or other rights
(and we also note that type="other" is a valid reference type)
Thanks, just about to check this in. One minor nit though, you copied the code for description by doing:
+ 'rights' : '',
+ if self._md['rights'] is not None:
+ desc = utf8_text_wrap(self._md['rights'], width=64,
+ subsequent_indent=' ' * 12 + ': ')
+ head += " Rights : %s\n" % '\n'.join(desc)
...which is a bug, as '' != None so it'll always show. (description "must" be present, which is why nobody has fixed it there).
I changed the test to:
+ if self._md['rights']:
...if you want to go the other way, shout.
Good catch, thanks.
Looks like I missed 'severity' from my patch, but it is in the new updateinfo.xml
For an abstract for testing, see
Abstract of RHN x86_64-client-5 updateinfo.xml as of Sept 15 2010
Please could you add 'severity' (should look almost identical to the code for 'rights'). Thanks
Posted for upstream ACK.
And thanks for the updateinfo.xml :).
Ok, I've finally got around to doing all the client stuff for this in the security plugin.
A couple of questions:
1. Do you want rights displayed by default? (I'm guessing it's going to be the same for all of them, but it's only one line...)
2. Do you want summary/solution displayed by default (seem big and useless, but meh).
3. Atm. I assume that severity is tied to security ... so the option is called --sec-severity, and so with --sec-severity=Critical the --security option does mostly nothing.
4. For "updateinfo list security" I'm doing:
FEDORA-2010-16593 security xulrunner-126.96.36.199-1.fc13.x86_64
FEDORA-2010-16883 Critical/Sec. xulrunner-188.8.131.52-1.fc13.x86_64
...where I've altered 16883 to have severity=critical (both are security). I assume this is fine?
5. For "updateinfo summary security" I'm doing:
11 Security notice(s)
10 ? Security notice(s)
1 Critical Security notice(s)
...and if they were call Critical it'd be:
11 Critical Security notice(s)
...again, I ignore any severity data for bugfix/etc. ... I assume this is fine?
1 - no, i we don't need to do this
2 - no, let's not do this either. If they are using yum security then the solution boilerplate isn't much use.
3 - ok
4 - ok
5 - ok
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.
(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)
More information and reason for this action is here: