users@glassfish.java.net

Re: GlassFish v3: Security updates - Which repository?

From: <glassfish_at_javadesktop.org>
Date: Tue, 13 Apr 2010 05:05:50 PDT

Hi Alexis,

thanks! So do I understand it correctly, that security updates won't be (publicly) available until v3.1? Or will there be a 3.0.1 release?

With my default repostitory settings, would I automatically update to v3.1, as soon as it's released?

I want to make sure, that I'm not missing out any security updates.

Cheers,
Chris


>
> On 6 avr. 2010, at 17:25, glassfish_at_javadesktop.org
> wrote:
>
> > Hi,
> >
> > my GlassFish v3 offers a list of preconfigured
> repository locations:
> >
> > (When installed from "sges-v3-unix.sh", downloaded
> from Sun):
> >
> > dev.glassfish.org
> > contrib.glassfish.org
> > dev.glassfish.sun.com
> > contrib.glassfish.sun.com
> > release.glassfish.sun.com
> >
> > (It's a little bit different when installed from
> "glassfish-v3-unix.sh", downloaded from java.net):
> >
> > dev.glassfish.org
> > contrib.glassfish.org
> > stable.glassfish.org
> > contrib.glassfish.sun.com
> > release.glassfish.sun.com
>
> This is odd, you shouldn't have "dev" repositories in
> stable artifacts...
> Note there's also the notion of preferred authority
> (repo)
>
> > Questions:
> >
> > (1) Why the difference?
>
> The Sun-branded is the only supported product.
> Similarly Oracle GlassFish Server will be the only
> supported product.
>
> > (2) Can somebody please explain the meaning of
>
> let me try...
>
> > "stable",
>
> Final versions of community bits.
>
> > "release",
>
> Final releases of supported bits
>
> > "contrib"
>
> This is for unsupported (but useful) bits.
> Note you can get your own packages to this repo using
> the http://glassfish-repo project (we should be
> reviving this community project).
>
> > and "dev"
>
> During the work on v3, this had weekly promoted
> builds (one could "pkg update" every week to get to
> the latest promoted build)
>
> > the way they're used by GlassFish?
> >
> > (3) If I only want security updates, which
> repositories should I enable? If I leave everything
> at default, I don't get any updates at all (are there
> no security updates since GlassFish Release 3.0?).
>
> There has been no pubic (community, free) update made
> available via the update center since the release of
> v3 in December.
> In general the default settings should work for most
> people and fiddling with repository definition can
> lead to "interesting" results.
> See
> http://blogs.sun.com/alexismp/entry/which_glassfish_v3
> _download_bundle for which bundle you should get.
>
> cheers,
> -Alexis
>
> > When I select a "dev" repository as "Preferred",
> and deselect the other repositories, I get several
> updates. But are these just security updates, or do
> they contain unstable changes?
> >
> > Thanks
> > Chris
> > [Message sent by forum member 'chris_l']
> >
> >
> http://forums.java.net/jive/thread.jspa?messageID=3955
> 26
> >
>
[Message sent by forum member 'chris_l']

http://forums.java.net/jive/thread.jspa?messageID=396668