rpmfind : the autoupgrade mode

What is it ?

rpmfind autoupgrade allow to keep a machine up to date based on a number of predefined update sources. It can also be used to upgrade to a new version of the distribution (currently only tested on Red Hat Linux and with rpmfind >= 1.8.0).

How does it work:

The autoupgrade mode takes as input one or multiple pool of package, in practice directories (file based, FTP or HTTP), scan then to look for packages susceptible to provide upgrades to locally installed ones. Then it will fetch them one by one trying to solve the dependancies. It then progressively update the machine with new packages from the sources provided.

Guarantees:

From a legal point of view, there is none. However the rpmfind autoupgrade mode provides the following guarantees to make people feel safe about using it:

• rpmfind will not modify the database itself, it is open read-only, it always forks the rpm command line tool to actually run the upgrade. You can specify the rpm command and the arguments to use from the config file.
• it will never force an upgrade: no --force or --nodeps is ever used
• by default rpmfind will ask first if you want to run a given transaction, I run it from cron and I desactivate this with "auto=yes" in the .rpmfind config file.
• it does not remove packages without asking. It may in some rare case prompt you asking if you agree with a package removal. You have the right to disagree, it will just block some other packages upgrades.
• it does not try to upgrade kernels packages, this is left to the sysadmin responsability.
• the upgrade is progressive and restartable, i.e. if something really bad happen during an upgrade the damage at the rpm database level are either non-existant or limited to the set of packages which where upgraded at that given time. Rpmfind autoupgrade really reduce the time where the database is opened in read-write mode and tries to make stransactions as small as possible.

I have run rpmfind --autoupgrade to maintain a set of servers with redhat updates for years. I have tried a number of upgrades of Red Hat distributions recently (6.2 -> 7.1, 7.0->7.2, 6.2->7.2 beta, etc.) I even upgraded the rpmfind.net server from 6.2 to 7.1, however YMMV !

Metadata sources:

When upgrading a package raise a dependency requirement problem, rpmfind will use the following to try to find the right package for the update:

• look at the filenames
• consult an rpmdb local database if it had been installed (it will try to install it by default if it is not present)
• search for compatibility packages in the remote pool
• query the rpmfind.net/linux/RDF metadata database

This is usually sufficient to find the right packages.

Running it:

Assuming you have a machine you want to upgrade to 7.1 (say mounted vian NFS) run the following:

rpmfind --upgradefrom /nfs/redhat/7.1/RedHat/RPMS

You must point it to the directory containing the RPMs. If you are wondering what are the package examined or how are the dependancies solved, run it with the extra -v (or 2 for really verbose ouput). rpmfind will run lilo or rpm --rebuilddb when updating those packages.

Once done it is a really good idea to also apply the security updates from redhat (again assuming you kept them locally on NFS):

rpmfind --upgradefrom /nfs/redhat/update/7.1

To simplify maintenance, add the two following lines to ~root/.rpmfind (which is created automatically):

autoupgradeURL=/nfs/redhat/7.1/RedHat/RPMS

autoupgradeURL=/nfs/redhat/update/7.1

It is a good idea to install the Red Hat GPG public key from a trusted source like a CD-ROM:

# mount /mnt/cdrom
# gpg --import /mnt/cdrom/RPM-GPG-KEY
gpg: key DB42A60E: public key imported
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: Total number processed: 1
gpg:               imported: 1
#

this will allow rpmfind to check the integrity of the packages.

Adding packages manually:

Suppose you do (like I did) upgrade Red Hat 7.1 to 7.2beta using rpmfind, new packages may not be installed, for example nautilus wasn't installed since it was not present in 7.1. The --install command allows to pick up a new package and its dependancies. The following command actually installed nautilus and all the needed dependancies (bonobo, eel, libsrvg, mozilla, etc ...):

rpmfind --install nautilus --noremotedb --upgradefrom /nfs/redhat/beta/roswell/i386/RedHat/RPMS

When logging in Gnome the next time, nautilus got launched (note however that using the normal upgrader for desktops should be the prefered option).

Caveats:

• this is not the supported way of upgrading a Red Hat machine you are on your own
• if some of the RPM packages have troubles, well you may end-up wih a non working package after the install (was the case for sawfish)
• you may have to restart some services manually if the packages post install scripts don't do it automatically
• some packages are tigthly dependant on the kernel, and upgrading them is not possible without upgrading first the kernel, this is left to the sysadmin to fix.
• this takes longer than regular upgrades, this is really intended to housekeeping and upgrade of machines which cannot be taken down (like in colocations).
• Sometimes rpmfind need to run rpm with the --replacefilesoption. This is due to a limitation of the dependancy solver of librpm. I will try to find a solution to this problem, in practice it never generated a problem, but this is a known bug.

Useful tips:

• before the upgrade launch a second sshd on a second port ... like sshd -p 23 (I assume you don't have telnetd up). Make sure you have a live connection to root though this second daemon just in case the sshd upgrade gives troubles
• though the update command is restartable in case of problems, it's better to make sure ahead that you have plenty of space on ~root before running a full system upgrade
• sometimes the upgrade history can generate troubles, if an upgrade doesn't really work well doing rm ~root/.rpmfinddir/autoupgradeHistory can help removing old stuff getting in the way.