I have been affected by few issues mentioned by Alfredo. 

* Version Pinning:  Had to install several debs of specific version to be able to pull dependencies of the correct version.  I believe that other projects resolving it by creating a virtual package that pulls all of the proper dependencies in.  Not sure if the same done by RPM / Yum.

* Unannounced releases.  I believe it is more of a procedural issue and unfortunately something will need to be done to enforce the compliance once rules of packages release are finalized.

* I am bothered with a quality of the releases of a very complex system that can bring down a whole house and keep it down for a while.  While I wish the QA would be perfect, I wonder if it would be practical to release new packages to a testing repo before moving it to a main one.  There is a chance then someone will detect a problem before it becomes a production issue.   Let it seat for a couple days or weeks in testing.  People who need new update right away or just want to test will install it and report the problems.  Others will not be affected.

Just my 2c,

On Tue, Sep 17, 2019, 8:15 AM Alfredo Deza <adeza@redhat.com> wrote:
Reviving this old thread.

I still think this is something we should consider as users still
experience problems:

* Impossible to 'pin' to a version. User installs 14.2.0 and 4 months
later they add other nodes but version moved to 14.2.2
* Impossible to use a version that is not what the latest is (e.g. if
someone doesn't need the release from Monday, but wants the one from 6
months ago), similar to the above
* When a release is underway, the repository breaks because syncing
packages takes hours. The operation is not atomic.
* It is not currently possible to "remove" a bad release, in the past,
this means cutting a new release as soon as possible, which can take
days

The latest issue (my fault!) was to cut a release and get the packages
out without communicating with the release manager, which caused users
to note there is a new version *as soon as it was up* vs, a
process that could've not touched the 'latest' url until the
announcement goes out.

If you have been affected by any of these issues (or others I didn't
come up with), please let us know in this thread so that we can find
some common ground and try to improve the process.

Thanks!

On Tue, Jul 24, 2018 at 10:38 AM Alfredo Deza <adeza@redhat.com> wrote:
>
> Hi all,
>
> After the 12.2.6 release went out, we've been thinking on better ways
> to remove a version from our repositories to prevent users from
> upgrading/installing a known bad release.
>
> The way our repos are structured today means every single version of
> the release is included in the repository. That is, for Luminous,
> every 12.x.x version of the binaries is in the same repo. This is true
> for both RPM and DEB repositories.
>
> However, the DEB repos don't allow pinning to a given version because
> our tooling (namely reprepro) doesn't construct the repositories in a
> way that this is allowed. For RPM repos this is fine, and version
> pinning works.
>
> To remove a bad version we have to proposals (and would like to hear
> ideas on other possibilities), one that would involve symlinks and the
> other one which purges the known bad version from our repos.
>
> *Symlinking*
> When releasing we would have a "previous" and "latest" symlink that
> would get updated as versions move forward. It would require
> separation of versions at the URL level (all versions would no longer
> be available in one repo).
>
> The URL structure would then look like:
>
>     debian/luminous/12.2.3/
>     debian/luminous/previous/  (points to 12.2.5)
>     debian/luminous/latest/   (points to 12.2.7)
>
> Caveats: the url structure would change from debian-luminous/ to
> prevent breakage, and the versions would be split. For RPMs it would
> mean a regression if someone is used to pinning, for example pinning
> to 12.2.2 wouldn't be possible using the same url.
>
> Pros: Faster release times, less need to move packages around, and
> easier to remove a bad version
>
>
> *Single version removal*
> Our tooling would need to go and remove the known bad version from the
> repository, which would require to rebuild the repository again, so
> that the metadata is updated with the difference in the binaries.
>
> Caveats: time intensive process, almost like cutting a new release
> which takes about a day (and sometimes longer). Error prone since the
> process wouldn't be the same (one off, just when a version needs to be
> removed)
>
> Pros: all urls for download.ceph.com and its structure are kept the same.
_______________________________________________
ceph-users mailing list -- ceph-users@ceph.io
To unsubscribe send an email to ceph-users-leave@ceph.io