Hacker News Reader

Comment by gergles | Hacker News Reader

What about this change from 'latest' to 'quarterly' with no good way to change that for pkg? I don't want to only get new packages 4 times a year. Is that what's going to happen?

It also feels like the documentation around doing things like pinning you could do in apt is lacking; if there are some packages I can say "retrieve these packages from latest" then I'd be more okay with everything else only updating 4x a year.

View on HN

> What about this change from 'latest' to 'quarterly' with no good way to change that for pkg? I don't want to only get new packages 4 times a year.

From the Release Notes:

> The default pkg(8) repository set in /etc/pkg/FreeBSD.conf now defaults to the quarterly package set. To use the latest branch (as was the previous default), the comment at the top of /etc/pkg/FreeBSD.conf explains how to disable the default repository and specify an alternative repository.

If I'm reading /etc/pkg/FreeBSD.conf correctly, swapping over to use HEAD instead of the Quarterly branch is as simple as creating /usr/local/etc/pkg/repos/FreeBSD.conf with the following content?

    FreeBSD: {
      url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest"
    }

edit: originally I replicated all of the contents of /etc/pkg/FreeBSD.conf in /usr/local/etc/pkg/repos/FreeBSD.conf, but based on pkg.conf(5), the contents of the latter override keys in the former, so you only have to specify the differences

Thanks for this information! It's strangely missing from the release and the comment in the /etc file.

Do you know how are the security updates propagated to quarterly branch? Are they backported till the latest Q release and shipped immediately?

Did you upgrade from a previous release? It might not have changed your /etc/pkg/FreeBSD.conf. I'm basing this off a fresh install.

And yes, my understanding is that the quarterly branch is supported for 3 months with backports of security fixes.

I haven't yet upgraded, just trying to understand it first. I've made a thread in the official forum, hopefully it'll get clarified. https://forums.freebsd.org/threads/default-repository-change...

FreeBSD's packages being so up to date is literally one of the reasons I switched to it from Debian.

I don't understand this change, nor why it's the default. Actually having up-to-date packages was one of BSD's biggest selling points. Sick of distros with package systems so out-of-date they might as well not exist.

Some organizations value stability over new features, which is why you see so many places using distros like debian stable, centos, etc. It may not fit your needs, but there are plenty of use cases for preferring stability and security over new features.

There are advantages, yes, not denying that, but it seems vanishingly rare to find a packaging system that doesn't have this problem, and that's frustrating in particular for a programmer when almost every single language you use doesn't have an up-to-date package and winds up requiring an external install that then isn't even necessarily version tracked.

And I do wonder at the security implications of that. Some of the more popular languages like Python get semi-regular security updates even on stable branches like Debian's, but then I see stuff like Racket still being on 5.2 which came out in 2011 and I have to wonder how that affects the security profile if some "stable" package you've installed is depending on a scripting language package that still has a vulnerability in it because the package in "stable" hasn't been updated in half a decade.

have you tried arch? sounds like you would like it :)

If you want updated packages as soon as they are available you can always use ports.

I often have, is ports exempt from this quarterly system though?

To my understanding, one package set is built from the head of ports; that's been the default till now. Every quarter they create a new branch from the head, give it a little time (weeks?) to shake out the bugs, and build the quarterly package set from that; this will be the new default.

I've been using the quarterly package set for some time now to avoid the occasional breakage I saw on the latest package set. Having three-month-old software is a totally worthwhile trade off for me.

There's no reason I know of that you couldn't switch back to the latest package set and keep building your ports from the head of the tree.

AFAIK portsnap has no concept of pulling from anything other than HEAD when updating the tree. You have to explicitly ask for quarterly via cvsup, if you only want quarterly release ports.

Reply on news.ycombinator.com