David Mathog wrote:
> So as an experiment today I compared three "automatic" patch retrieval
> methods: pca --askauth -d all (with and without service contract
> access) and the current patch cluster (with service contract access).

Be aware that the "all" patch group contains both missing patches and
patches which are already installed on your system. If you want to
list/download/install missing patches only (which makes a lot of sense),
use the "missing" patch group with pca; this is the default if no patch
group is specified.

> Comparing the entries in the first two showed a lot of overlap, but
> there were entries in each that were not present in the other. For
> instance, 108569-08 was in PCA and 108576-52 was in the patch cluster.

The approach used by pca to determine missing patches is actually quite
simple - it shows all patches which are for packages installed on the
system, not more and not less. Behind the scenes, it handles some
patches in a special way though, as the patch metadata in patchdiag.xref
often is incorrect.

> 1085690-08 is "X11 6.4.1: platform support for new hardware" which is
> roughly correct (the hardware for this system is included) but not
> really needed (there is no graphics "head" on the system.) 108576-52
> is "SunOS 5.8: Expert3D IFB Graphics Patch" which is related to the
> SUNWifb package, which is not installed on this system either.

To determine whether pca is correct is usually quite simple - just try
to install the patch. pca used Sun's patchadd, and if it installs the
patch then it obviously is fine. If a patch shown in pca's missing list
doesn't install, that's a bug; feel free to report it. The above example
shows that pca is correct.

> I think it will be ok to skip patches 5,6,9 so long as a I never
> hit Asian or Arabic language sites,

5,6,8,9 are not shown by pca because you do not have the packages for
these locales installed, so the patches are not needed either.

In my experience, firefox always worked fine without these
packages/patches; I had disabled the patchchecker in firefox as well to
get rid of the warnings.

> I'm not quite sure what the base package is for those patches, although
> it appears that it may be iconv. The patched files are not currently
> present on my system.

You can find out about the patch<->package relation by looking at
patchdiag.xref, or by unzip'ing the patch zip file and looking for the
SUNW* directories included.

> The absence of patch 8 in the non service contract pca list was odd.
> It might have been a glitch. Hope so. Otherwise folks without a
> service contract are not going to be able to run this version of Firefox
> on Solaris 8.

113261-02 is not a Security patch, so it's probably not available for
non-contract customers. I don't think that it really breaks firefox, though.

> For patch 2 PCA correctly picked up the final patch in the chain, but
> for some reason also kept the final patch in the series before the patch
> number changed. Perhaps that is a bug in pca.

See above - don't use "all".

If you want to download/install exactly those patches which apply to
your system, PCA really is the way to go. With the clusters, you will
always download patches which do not apply to your system or which are
already installed.

Hope that helps,

mp.
--
SysAdmin | Institute of Scientific Computing, University of Vienna
PCA | Analyze, download and install patches for Solaris
| http://www.par.univie.ac.at/solaris/pca/