TurnKey security updates

Peter Eisentraut wrote:
> Robert Treat wrote:
>> Since turnkey doesnt update packages themselves (they just grab ubuntu
>> feeds), do they need a contact for the list? Or would that preclude
>> them from being listed on the download page? (I'd also note that
>> Robert Bernier is not on the -packagers list (afaik) , but he now has
>> a distribution listed as well (pg_live))
>
> Well, does he produce a new release on time for every source release? Or
> is it more like when the conference schedule calls for it?

Conference schedules? Sorry, we don't have any plans to attend any, so
we have to use a different system to determine our when to do updates.

To the point. While new releases do in fact include the latest package
updates as part of the build process, we don't need to release a new
software appliance each time a single package gets updated, because the
package manager is configured to take care of that for you. The
appliance is configured to auto-update security patches daily, directly
from Ubuntu's security repositories.
We also have our own security repository (archive.turnkeylinux.org) but
we only issue updates for our custom packages there.

This is kind of how Ubuntu and Debian handle updates. You wouldn't
expect them to make a new release for every package that gets updated,
and it wouldn't really be very useful if they did anyhow because it
wouldn't take care of already installed systems.

Again, I'd like to stress that under the hood TurnKey appliances are
simply an Ubuntu system that has been pre-integrated and optimized to
satisfy a specific usage scenario.

Hope that clears it up!

Cheers,
Liraz