"William Allen Simpson" <wsimpson@greendragon.com> wrote:

> Then, you have 1,000 (10,000? 100,000?) folks like me waiting about 14
> hours for `cvs up`, compiling -current, discovering that the build fails,
> re-cvs (only about 7 hours this time), -u build, discover the flist is
> bad, re-cvs, -u distribution (still running at this moment)....
> Basically, 2+ days, and still not updated, and this on a dedicated
> test machine.  I shudder to think what production systems are doing.

You'd be better off following the procedures indicated in our security
advisories.  The security advisories always outline straightforward
instructions how to update your system.  This usually involves running cvs
update and make in a few selected directories.  I believe this scales well
and this is what production systems are doing!

If you do not want to wait for the security advisory, you can usually deduce
from the commit messages which directories you have to update and rebuild.

If you do not have a checked out source tree to start from, you can grab
tarballs of the source tree from our ftp servers.

> Perry (and others) say there are some ideas about the future, and I'm
> interested in helping make that happen.  The status quo is not good.

I'd hope that at some point we'd be able to provide binary updates which
include only the updated files and can be extracted over an installed
system.

-- 
Christian Limpach <chris@pin.lu>