Subject: ["Theodore Y. Ts'o" <[email-masked]>] [Erik Troan: RPM 2.1 now available]

From: Mark Eichin <[email-masked]>
Date: 11 Jul 1996 17:33:01 -0400

The new RPM is out...

------- Start of forwarded message -------
Date: Wed, 10 Jul 1996 19:53:03 -0400
Message-Id: <[email-masked]>
From: "Theodore Y. Ts'o" <[email-masked]>
To: [email-masked]
Subject: [Erik Troan: RPM 2.1 now available]

FYI....

------- Forwarded Message

Resent-Date: Wed, 10 Jul 1996 17:38:25 -0400
Date: Wed, 10 Jul 1996 17:37:36 -0400 (EDT)
From: Erik Troan <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Subject: RPM 2.1 now available
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Resent-Message-Id: <"4DNNB1.0.ia1.HB2vn"@redhat.com>
Resent-From: [email-masked]
Reply-To: [email-masked]
X-Mailing-List: <[email-masked]> archive/latest/412
X-Loop: [email-masked]
Precedence: list
Resent-Sender: [email-masked]
X-Url: http://www.redhat.com

After weeks of promising everything to everybody, RPM 2.1 is now ready
to show which promises we *really* meant.

It's available from ftp.redhat.com:/pub/code/rpm as rpm-2.1-1.i386.rpm.

The highlights of the new release include:

	1) Dependencies
	2) Relocateable packages
	3) Support for building and installing packages as non-root user
	4) Multiple signatures
	5) Comments in spec files
	6) Architecture generalizations
	7) Enhanced querying via --queryformat

Available in ftp://ftp.redhat.com/pub/code/rpm:

rpm-2.1-1.i386.rpm       -- Intel binary RPM
rpm-2.1-1.axp.rpm        -- Alpha binary RPM
rpm-2.1-1.sparc.rpm      -- SPARC binary RPM
rpm-2.1-1.src.rpm        -- Source RPM
rpm-2.1.tar.gz           -- Source tar file
rpm-2.1-1.i386.cpio.gz   -- Intel binary cpio archive

Note that packages built with rpm 2.1 and later cannot be used by rpm 2.0.x 
releases.

If you have any questions or comments about this release of rpm or the
new features in it, please direct them to [email-masked].

Enjoy!

Marc & Erik

PS: For those who are interested, here's the changes for this release:

2.0.11 -> 2.1:
        - added --requires, --whatrequires, --provides and
          --whatprovides queries
        - using a string array tag in a queryformat results in every
          item in the string being printed out with spaces in between
          (though this behaviour will probably go away shortly)
        - all packages are ftp'd before any are installed (required to
          do proper dependency checking)
        - if only source packages are being installed, the database is
          never opened
        - automatic shared library require/provides tags generated
        - added --nodeps flag for install and uninstall
        - added dependency checking for installs and uninstalls
        - misc fixes to compile with glibc
        - use PGPPATH if set (and no pgp_path: in rpmrc)
        - remove pgp_pubring, pgp_secring stuff
        - new extensible signature
        - signature section supports multiple signatures
        - --addsign to add a signature to a package
        - PGP key no longer limited to 1024 bits
        - always do at least an MD5 "signature"
          as a result, -K will always tell you something
        - signatures now include a simple "header+archive size" check
          just calling readSignature() checks this
        - --nopgp (with -K) to skip PGP check, just do MD5
        - allow '#' comments in preamble and %files section
        - fixed -qsv to print both the states and the file information
        - added --dump option to query to print all file attributes
        - installs with --root use the /etc/passwd and /etc/group from
          the target directory
        - added --initdb to aid in database initialization
        - --queryformat can print items of type INT8
        - "sourceless" packages with nosource: and nopatch:
        - [] now allows interation through query formats
        - '-' flag for query tags removed
        - :date and :perms supported as query format specifiers
        - new rpmrc entries "arch" and "os" to override
        - --arch and --os on the command line to override
        - arch and os are now strings in the package header
        - added arch_compat handling in /etc/rpmrc
        - added build_arch to /etc/rpmrc
        - support arch as string
        - added --ignorearch option
        - Prefix: in spec file to specify default installation prefix
        - rpmrc and command line may be used to override the path
          used for the rpm database
        - relocatable packages get installed properly
        - added support for --prefix and RPM_INSTALL_PREFIX environment
          variable
        - added dependency checking for version numbers
        - added correct dependency checking for upgrades
        - added :depflags query format flag
        - changes --provides, --requires, and --scripts queries to use
          queryFormats

--
To unsubscribe: mail -s unsubscribe [email-masked] < /dev/null

------- End Forwarded Message
------- End of forwarded message -------

---

From: Yves Arrouye <[email-masked]>
Date: Wed, 17 Jul 1996 21:03:56 +0200

> 	3) Support for building and installing packages as non-root user

As I understand it, we will have support for building non-root. I still
consider that it would be nice to be able to install non-root, which may
easily be done (as long as not setuid/setgid files need to be installed)
as follows:

  - make dpkg setgid to a 'pkgmgr' (or whatever its name) group;
  - (eventually, dpkg adds /usr/sbin to its path at startup);
  - make /var/lib/dpkg files writable by the pkgmgr group;
  - dpkg only uses this group when maintaining files there, and if not
    root does not try to restore ownership when installing files.

Now if someone non-root wants to install, he must just have enough
permissions to create the files. (I know this is incomplete, but it's
feasible).

This would of course be of a great interest if some packages could be
relocated, their package scripts getting a new argument giving the
root of installation in order to configure the files correctly.

Yves.

---

From: Ian Jackson <[email-masked]>
Date: Fri, 19 Jul 96 22:16 BST

Yves Arrouye writes ("Re: RPM 2.1"):
...
>   - (eventually, dpkg adds /usr/sbin to its path at startup);

dpkg is completely unsuited to being installed set-id.  The security
implications of this are tremendous, and you don't want to try to deal
with them in the context of a program like dpkg.

>     root does not try to restore ownership when installing files.

This last option would be reasonably easy to implement.  If you send
me good patches I'll apply them.  If I don't like them I'll tell you
so :-).

...
> root of installation in order to configure the files correctly.

This is difficult.  There is certainly insufficient effort available
to implement it.

Ian.