Updating packages based on glsa-check output

[abduct]

This may be a super simple question, but how do you fix problems that glsa-check finds by hand?

I don't quite trust an experimental tool to patch my system itself especially since the option within gsla-check --help says "experimental" in the description.

Do I just emerge the up to date packages like I would normally update software, or does glsa-check apply some sort of patches it pulls from else where where emerge does not.

Here is a sample list of what I'm trying to update if it helps:

[skiwarz]

If you browse through some of the GLSAs posted at https://security.gentoo.org/glsa it seems like the resolution for all of them is to update to the latest version. So whether you do so manually or use glsa-check -f to apply that resolution (update your programs), I suppose the same end result is effected.
As far as whether there is some "extra code" that GLSA-check pulls in, I doubt it. That code would eventually have to be patched into newer versions of the program anyways, so wouldn't they just release a new version of the program instead of having a separate "patch"? I don't know exactly how glsa-check works, but it seems like a pretty simple program. You could always browse the source code to find an exact answer

Are you getting those results from glsa-check before or after you update your system? ie [emerge -uDN world] or something similar

[depontius]

Years back, I ran my mother's computer this way. I'm sorry to say that I don't remember the scripts I used to do the job.

We'd visit every fall and spring, and I'd completely update her computer while we were there. In between I ran updates based on glsa-check, essentially a security-fixes-only policy. You're right, in that it's usually updating to the latest version, but it's a question of how much of the system do you want to update. Most times Gentoo updates easily, but sometimes there's a problem like expat, or gcc or xorg updates are usually messy. I prefer to save things like that, along with kernel updates, for when I'm physically present.
_________________
.sigs waste space and bandwidth

[abduct]

[skiwarz]

Here's what "glsa-check -f" does:

[abduct]

I see I started to view the code as well after finding it and came to the same conclusion.

I also had to do some research what --oneshot did. I knew the basis to it but not really what if effected at the time.

I also played around with some more of the options such as -p and the "affected" identifiers which printed out what it would update to patch the advisory as well as which version it would pull in.

I also have demerge installed so now if something absolutely does go wrong I can attempt to at least revert back to a previous restore point to recompile the original versions of software with *hopefully* not to much damage.

-------------------------------------

I don't see it trying to figure out use flags or anything so does emerge already know which custom flags you used per package when updating? Since I might of forgot to put some custom use flags to customize specific software into the make.conf or other related files.

I'd hate for it to update something and just use default USE flags when I decided to use some other flags with it.

Thanks for the help so far.

[skiwarz]

I'm not an expert on this stuff, so I could be wrong here. But I think it would use whatever flags are given in the config files. So all your flags from make.conf and any you specified in package.use. But if you emerged the program with command-line use flags, those will be excluded. I could be wrong, but that makes sense to me. I haven't looked at the code too much.

[abduct]

[skiwarz]

Isn't there a way to do that with equery or something? I could have sworn I've looked up which use flags I compiled with for specific programs before.

[abduct]

There's no automated way, but I worked around it. I don't plan on doing a full system update any time soon so I just ran `equery uses <pgk>` on all the outputs that glsa-check gave me and double checked if their use flags were in a make.conf. If they wern't I used `euse -E <use flag>` to add them to which ever make.conf it uses (I believe it's the one in /etc/portage rather than /etc/make.conf).

Once this is done I went and ran `glsa-check -v -f affected` which is currently doing it's job. I really wish they had a --pretend option to see what it will actually do before running it for real. I'll have to see if I can track down the dev or something about it.

Thanks for all the support.

[skiwarz]

If you wanted to use the --pretend option, I remember seeing in the glsa-check script where it says