[Rpm-metadata] metadata list and discussion over tapas tonight

[Joe Shaw]

On Tue, 2003-08-05 at 12:52, seth vidal wrote:
> Do you mean older packages that aren't on the repository?
> 
> So if I've removed foo-1.1-1.noarch.rpm and replaced it with
> foo-1.1-2.noarch.rpm you want to keep the info on foo-1.1-1?
> 
> or do you mean if I've just added foo-1.1-2 w/o deleting foo-1.1-1 then
> have both sets of information?

Sorry, I should have been more clear.

I mean the latter: keeping around older versions of the packages, both
in metadata and in the repositories themselves.

So, yeah, consider foo 1.0 on my system and in the repository.

We release foo 1.1, which fixes a major security hole, and mark the
importance "urgent".

We then release foo 1.1.1, which is just a minor bug fix release, and
mark the importance "minor".

It's important to keep around the metadata for 1.0 and 1.1, in addition
to 1.1.1, so that we can properly convey the severity of the update
(updating 1.0 -> 1.1.1 should still be "urgent", not "minor"), but also
to allow the user to downgrade or rollback from 1.1.1 to 1.1 or 1.0.

Joe