On 26/09/14 09:29, Werf, C.G. van der (Carel) wrote:
> I'm using scientific Linux for quite a long time now (since 5.1),
 > and I still cannot follow the update policy of the repository maintainers.

Mostly, the policy of SL is to follow the upstream vendor (TUV).

> For instance a quite valuable package as OpenLDAP.
 > .... > ... why is SL6x-repo still  delivering 2.4.23 ?? Which contains a 
documented bug ...

> 2.4.39 Release Changes
>      OpenLDAP 2.4.39 Release (2014/01/26)

When I look into the current package on SL6 using:
    rpm -q --changelog openldap

I find at the top:

   * Tue Jan 28 2014 Jan Synáček <[log in to unmask]> - 2.4.23-34.1
   - fix: segfault on certain queries with rwm overlay (#1058250)

I haven't done the work of correlating that, but the dates strongly suggest 
that this fix in late January was a backport of the bug fix upstream two days 
earlier.

> So could anyone explain the reason why it takes sometimes more than years to find a package updated.

TUV generally does things this way.  Rather than push out a newer version with 
sundry changes to functionality, and perhaps new bugs, they take the trouble 
to back-port the fix of the particular issue.

The result is intended to yield more stable systems.  The version numbers can 
be confusing until you know this might be happening, but they should allow you 
to work out which features to expect, not which bugs aren't fixed.

Hope that helps.

    Shane
-- 
Shane Voss, Computing Officer, School of GeoSciences, University of Edinburgh

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.