Beware: External repos can break key transition

[Thorsten Leemhuis]

On 16.09.2008 03:24, Warren Togami wrote:
> BTW, I just thought of a horribly ugly but automatic working solution to 
> this problem: Filter the require on "xine-lib(plugin-abi) = 1.24" from 
> that package.
> 
> This sucks, but at least yum update will upgrade to the latest N-V-R 
> packages in both repos so this doesn't exactly break anything.

It breaks for some times: let's say xine-lib (Fedora) and 
xine-lib-extras-nonfree (Livna) get both pushed to their repos at round 
about the same time (like it was the case for the recent packages). Then 
there is a time window that's afaics round about somewhat between 24 and 
36 hours long(¹) where yum on the user's system might chose to use the 
livna master repo (or a up2date livna mirror) and a Fedora mirror that's 
not up to date.

Thus yum will install the new xine-lib-extras-nonfree from Livna, but 
not the matching xine-lib from Fedora. Thus all apps that rely on xine 
will silently stop playing some videos that they were able to play 
beforehand. I'd call that breakage ;-) A breakage that IMHO is not 
acceptable, as users won't know what's up and might file bugs.

CU
knurd

(¹) time configured in yum for metadata_expire + time until 
mirrormanager stops pointing yum to mirrors that don't ship xine-lib; 
manually configured mirror that are out of date will make things worse