Firefox and -stable ports

[moosejaw]

I am interested in running OpenBSD as my main desktop OS, after a bit of tinkering/getting used to it over the past few months. As I await the arrival of my 4.8 CDs, I'd like to ask a question / confirm what I think I understand about running Firefox on OpenBSD -stable and/or the patch branch for a particular release. (This is a question that I still have after lots of Googling and repeated readings of the official OpenBSD FAQ.)

My understanding is: if you run -release + patches, or if you run -stable, then any third-party packages or ports you run must be those that shipped with the release, or that are in the -stable ports tree. For many third-party packages, this is no problem, and there is nothing wrong with being a few months behind the bleeding edge. For Firefox, which has frequent critical security updates, getting those updates seems quite important. So here are my two questions/requests for confirmation:

1. If you run -stable, then you cannot run any version of Firefox that is newer than the one found in the -stable ports tree. This means that you rely on the maintainers of the -stable ports tree for Firefox security updates. (And I understand that -stable ports were revived last year, after a period of dormancy.)

2. Is it okay to use a patch branch system (i.e., -release + patches) with a -stable ports tree? From the FAQ, it seems that -stable doesn't introduce any major system/library changes that aren't also included in the patch branch, so I think this would be okay, but of course I could be completely off-base.

I realize OpenBSD is a small project and can't be all things to all people. My ideal scenario would be to run the patch branch, in order to avoid the frequent upgrading and possible breakage that can occur when running -current, but to have an up-to-date Firefox. Is this a reasonable thing for me to be able to expect to do? Do folks here know if Firefox is kept reasonably up to date in the -stable ports tree? Or is running -current really the only way to keep up with Firefox? Thanks in advance for any knowledge/advice you can share.

[jggimi]

There has been little difference in the last few years between -release+patches and -stable. That does not mean that there may not be significant differences once more. It depends on the patches and their severity or audience.

For the purposes of the rest of your questions, you can consider -release, -release+patches, and -stable as equivalent.

No library changes, structural changes, or functional changes are permitted in any errata patch or -stable patch. You are safe, therefore, intermixing -release and -stable ports/packages with -release,-release+patches, or -stable.

If you cannot wait for a -stable version of a Firefox release to be built, you can always attempt to backport a -current version yourself, if you have the technical skills. Note that creating a backport may not be technically possible; there may be some dependency on a newer library version within that hypothetical Firefox release or its dependency chain.

[ocicat]

Originally Posted by moosejaw

My understanding is: if you run -release + patches, or if you run -stable, then any third-party packages or ports you run must be those that shipped with the release, or that are in the -stable ports tree.

Basically correct. Sometimes, updates are pushed down to the -stable & even the -release branches. You can determine if updates have been pushed down to these branches by looking at the CVS tree. As an example for Firefox 3.5 (Firefox 3.6 is currently unavailable due to the impending release of OpenBSD 4.8...), the project's Web interface for the ports tree shows that the Makefile was updated a few days ago:

http://www.openbsd.org/cgi-bin/cvswe...www/firefox35/

Clicking the link for "Makefile" shows the individual check-ins & more importantly for this discussion, the CVS tags. Note that Revision 1.40.2.1 has the tagname OPENBSD_4_8. This is the tag associated with the -stable branch. If additional updates are pushed to -stable, this tag will move to a newer revision.

On the other hand, the tag OPENBSD_4_8_BASE denotes the version of Makefile associated with -release. Most likely, this tag will never move from Revision 1.40, but if any changes were pushed down to 4.8-release, you would see this tag move to a newer revision too.

If you run -stable, then you cannot run any version of Firefox that is newer than the one found in the -stable ports tree. This means that you rely on the maintainers of the -stable ports tree for Firefox security updates.

Correct, however, updates sometimes are pushed to -stable.

Is it okay to use a patch branch system (i.e., -release + patches) with a -stable ports tree? From the FAQ, it seems that -stable doesn't introduce any major system/library changes that aren't also included in the patch branch...

The bulletproof answer is to always match the version of the ports tree to that of the system, however, running -stable ports on -release should be alright.

Do folks here know if Firefox is kept reasonably up to date in the -stable ports tree? Or is running -current really the only way to keep up with Firefox?

I don't closely follow -stable as I run -current. Perhaps others will respond with their experience, but you can always trace through the CVS tree yourself to determine whether the lag is acceptable.

[moosejaw]

Thanks to you both, and in particular for the information on how to read the CVS tree info on the web, ocicat.