[Yum-devel] Fedora update metadata

[seth vidal]

> On Mon, 2005-06-20 at 16:45 -0400, seth vidal wrote:
> > Like I responded to Matt, doing this via a cgi (xml-rpc) that createrepo
> > can access for the right information is probably the most simple way
> > forward.
> 
> Sure, although how the data gets pulled in by createrepo is less of the
> first concern (imho).  If we have the format defined, then it's easy
> enough to get things generated even if there's some Magic (tm)
> 
> > The questions are all in the formatting:
> > - do we put one package per file (that gets bulky on disk)
> > - one file for all the update info for all packages  (that gets bulky to
> > read through and download)
> > - a combination of both so in the first case downloading only one is
> > easier and in the second case searching is easier.
> 
> One file per update is probably going to scale the best for the actual
> textual information -- the single file solution is going to grow quite a
> bit.  If I just look at the fedora-announce-list archives, it's about
> 200k of gzipped text per month.  Granted, that's two releases worth, but
> it still makes for basically doubling the size of the metadata pretty
> quickly.  Then just mapping per package -> the text of the update with
> an identifier (/location) in the primary.xml.  We'll also probably want
> an easy index of the update "titles". 
> 
> That then makes it so the full information can be grabbed on an
> as-needed basis which will help cut down on what needs downloading for
> the common case.  It also makes it so that translation can be done just
> by having files in lang-specific paths without having to regen all of
> the metadata to add a translation.

Who wants to define the magical and arbitrary format? any takers? All it
needs is something like:
 package
 distro
 version
 description of problem
 URLS
 CVE's resolved
 SOME MAGICAL IDENTIFIER


anything else?

A parser + display for that shouldn't be too hard. The filename should
be based on the pkgid in the primary.xml.gz for each package.

Work for y'all?

-sv