Hello, > 1. Is it right if I'm thinking that I only need to rebuild a > software in /usr/src if there is a security update for it (on > the errata page)? > For example there was a security update for httpd at 2006.07.30.
You don't have to do an entire rebuild in /usr/src. When a new security patch is out, download the patch and read the first few lines of it. Try downloading the 004_httpd_patch and have a look at the first lines, it will describe what you have to do. > 2. It is not clear for me that why can I find a package > called 'dovecot-1.0.beta8.tgz' under > ftp.openbsd.org/pub/OpenBSD/3.9/packages/i386/, and I can not > find this package under my updated (from the -stable branch) > /usr/ports tree. > However, there is a 'dovecot-1.0.beta3.tgz' package which > exists under both places. Hmm ... perhaps you did not correctly update your sources: http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/dovecot/Makefile?only_with_tag=OPENBSD_3_9 > 3. I don't know what is the releationship between the > ports.openbsd.nu site and the OpenBSD project, so this will > maybe an OT question. I can find a dovecot-1.0.rc2p3 package > on ports.openbsd.nu. Is that only in the -current ports tree, > and that is why I can not find it under my -stable ports > tree, or is that a totally different ports tree, and I must > checkout from there, if I want to use that software. >From the few visits to the site, the ports.openbsd.nu shows updates and new >additions to the "current" ports tree. I think ports.openbsd.nu is a "nice" parallel project to openbsd. It is not really part of the project itself, some volunteers did this nice job and now we have a cool web interface so that we are able to see the latest port news. The actual "current" tree is the ports collection for the upcoming openbsd 4.0., you should not use it for the openbsd_3_9 stable branch. Perhaps 'dovecot-1.0.beta3.tgz' was updated to beta8 in the stable branch because of a security issue. Have a look here: http://www.openbsd.org/faq/faq15.html#PortsSecurity If 'dovecot-1.0.beta8.tgz is available you should use this version. I hope this helps Kind regards Didier
