[Scribus] rpms-distro-padlock

[Peter Linnell]

On Mon, 2004-06-07 at 22:10, Bart Alberti wrote:
> I complain that the rpms made available from scribus.net specifically for
> the distributions --- and I have SuSE 9.0 -- show in YAST a "padlock icon"
> with the tool tip "do not modify."  I do not approve of this. the *-ulb_
> rpms one gets from rpm-find ALSO do this.  Does that mean one can not
> upgrade in the usual way?
> rpm -Uvh

> I compile form source ANYTHING I can which does not EXACTLY come from SuSE.
> I have made exceptions. It sometimes causes problems.
> Kindly explain.
> 
> Bart Alberti
> bart at solozone.com
> 

Although I am relatively new to Suse, I built the rpms without any
special switches or spec file options to cause this behavior. AFAIK
there is nothing in RPM as a packaging mechanism to do this except the
use of epoch, which is basically unused by Suse from my observation.

e.g foo-{%epoch}:{%release}-{%version}.{subversion}.{%optional
dist-tag}.rpm

However, I do have more than passing knowledge of rpm building - my
Inkscape rpms have been QA'd for Fedora Stable. I do Fedora packaging QA
and their standards are honestly IMO *far* more precise in usage than
Suse or Mandrake. Probably, in some cases _too_ pedantic. I've looked at
spec files for others which could break a RH system because of
sloppiness.

I suspect "locking" is the default behavior of yast2. I noticed the same
thing with all the custom rpms (Inkscape, GIMP 2.0.1, newer versions of
Suse provided apps, GCC 3.4.0) I built and installed for Suse 9.0, when
I upgraded to 9.1.

Unlike Anaconda from RedHat, Yast2, seems to put the lock icon to
protect self built rpms from being over written or removed. This IMO is
*exactly* the behavior I would want.

And certainly you should be able to able to upgrade either via rpm -Uvh
or -Fvh - provided you are in fact upgrading a package version. Older
versions can "upgrade" newer ones via --replacefiles --oldpackage.

You can also over ride the lock icon in Yast2 and replace with a Suse
provided RPM.

As for firefox doing funny things to downloads, not much I can do about
that.

I think the rpms provided on www.scribus.net, including the linked ones
for Mandrake and Debian Builds are distro caliber. I have long wanted to
provide them, but only when we could do it properly, right down to
putting the app icons in the menus following the latest freedesktop.org
recommendations. Of the several thousand downloads, we have had almost
no issues with the rpms and in every case we learned something was local
to the machine. 

All the RPMS, tarballs and debian packages have md5sums provided on the
download pages AND GPG signatures to verify their integrity.. we take
binary security and source integrity pretty seriously IMO. 

I hope that helps to clarify the situation.

Peter

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://nashi.altmuehlnet.de/pipermail/scribus/attachments/20040608/21b15f98/attachment.pgp