Request for Comments: updating RPMs using binary deltas.

[Jef Spaleta]

Lamar Owen wrote:
> The rpmdiff would be generated by the build process, and then the >
rpmdiff would be uploaded.

I don't think that was really Seth's point. So let me say what i think
his point was. How much extra space do mirrors have to supply to mirror
the rpmdiffs an an OPTION as well as the fully cooked update rpms. Over
the lifetime of Core, how many different kernel updates do you expect to
see rolled out for example? How much space are you really talking about
mirrors providing for the OPTION of using a collection of rpmdiffs over
the accumulated lifetime of a core release. You can not get away from
providing full rpm update packages. I'm certainly not prepared to
entertain the idea that if I have a custom or alternative package
version install that I need to downgrade all the way back to the iso
release version then apply 7 updates. All those extra steps is bound to
add extra fragility.

> Require the CD/ISO/as-released RPM to be used.  Check its signature, or even 
> its MD5/SHA checksum to make sure.  You may get bit anyway with locally 
> generated stuff and full RPM updates.

If there is ANY chance of getting bit because you are using custom rpms
or Fedora Alternatives or 3rd party alternatives...that's pretty much
NOT inline with the project structure and objectives as presented so
far. What is the POINT exactly of having rpmdiffs to confuse things when
trying to use Fedora Alternatives and 3rd party repositories. 

I'd MUCH rather concentrate on working out better ways for users to get
access to official mirrors of the update rpms so we don't see the aweful
bottleneck we are seeing right now at the fedora.redhat.com download
server, than complicating the alternative packages situation by putting
efforting into an OPTIONAL rpmdiff idea that can not be garunteed to be
SAFE and EFFECTIVE for people who use custom or aternative rpms. I
personally think that Fedora Core's default set of packages satisfy the
needs perfectly of exactly 3 users in the userbase. I fully expect
everyone but those 3 people to feel a NEED to build or find an
alternative package for at least one Core component.  

-jef