enterprise-ubuntu team mailing list archive

[Bolesław Tokarski <boleslaw.tokarski@xxxxxxxxx>]

Hello,

I wanted to get your opinions/experiences/solutions used for automatic 
updates.

I guess the 3 most common automatic upgrades approach are:
1. Go with it - install everything from upstream repositories.
2. Delay it - make a set of machines test the updates first before they 
are deployed everywhere
3. Verify it - go through each update and (dis)approve
4. Abandon it - Linux is secure, why should I update it?
(note I meant 3 are most common, 4th is not ;)

For 10.04 we went with 1. but under the exception that some packages 
were modified like in 3.
For 12.04 we go with 1. - the custom packages are added-on and do not 
override any package from Ubuntu.

The advantages of 1. are numerous:
1. Security - your systems are always up-to-date and you are unlikely to 
be behind with security vulnerabilities
2. Low (or no) amount of human intervention required. It just happens.
3. You are free to use any of the official Ubuntu mirrors on the 
Internet. Company laptops do not need to rely on corporate network to 
get updates.

The problems we have with 1. are:
1. You never know what's going to happen with the next update, 
especially if you have custom add-ons to updated software. In some cases 
you need to adjust your add-ons quickly. By custom add-ons I also mean 
custom configuration.
2. There is no way to actually block a package that causes issues.

Although Ubuntu provides the -proposed repository where packages that 
will land in main reside for at least a week (that would be enough for 
us to either prepare assisting changes or report that the packages 
causes issues here), we had a number of issues with updates that landed 
in -security which does not do staging in -proposed. Namely, these were 
Firefox and Thunderbird.

I did not find a reasonable tool to do 2 or 3. Perhaps Landscape can do 
it, though I believe some required functionality is in development yet. 
We have used reprepro for filtering the package updates, but this caused 
another issue: when people went home, they either had no access to 
regular packages (no corporate connection) or they got updates from 
Ubuntu upstream that broke their environment.

So, I was thinking how you approached the topic? Perhaps somebody has 
their custom Ubuntu repositories (not add-on repositories, I mean the 
whole ~100GB/distro) on the Internet? Or did you do some tweaks to block 
updates to specific software before it's tested?

Cheers,
Ballock