[TriLUG] rpm database question

[Mike Johnson]

Jon Carnes [jonc at nc.rr.com] wrote:
> > 		Production Boxes:
> > 		   _Nothing_ goes on the box that isnt an RPM.
> >
> You have got to be kidding me...  You mean you wait for an RPM fix when 
> there is a vulnerability announced?

He didn't say that.  He said that he doesn't install anything on
a production box that isn't in an RPM.  This doesn't stop one from
creating their own RPMs out of the tarball that comes out as a
result of an announced vulnerability.

Given a source RPM, it's trivially easy to upgrade it using a
tarball from the provider that's been patched.

Keeping everything in RPM make life -so- easy when you're trying to
verify versions of installed software.  Since everything is standardized,
it's -way- easy to parse.
 
Mike
-- 
"Yeah it is! Cause he's bakin' in the...kitchen of darkness!  A pie of
lost souls...until it's golden brown!" -- Moltar on Space Ghost