RFC: Yocto LTS?

RFC: Yocto LTS?

[Chris Simmonds]

Hi,

Is there a statement about the period of support for a Yocto release?
Looking through the updates, it seems that 12 months is typical, a was
the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
declaration anywhere that this is the expected norm.

Leading on from that, is 12 months enough? Most projects have a
lifecycle that is much longer. Is there an argument for an LTS Yocto
release, maybe once a year? If not, what is the recommended way for a
project developer to keep a distribution up to date in the light of the
several well-publicised security flaws that have been discovered over
the last year or so and the new ones that will no doubt be discovered in
the future?

Regards,
Chris Simmonds

Re: RFC: Yocto LTS?

[akuster808]

Chris,


On 10/14/2015 06:28 AM, Chris Simmonds wrote:
> Hi,
> 
> Is there a statement about the period of support for a Yocto release?
> Looking through the updates, it seems that 12 months is typical, a was
> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
> declaration anywhere that this is the expected norm.

There is a release every 6 months.

https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_release_cycle_of_the_Yocto_Project.3F

> 
> Leading on from that, is 12 months enough? Most projects have a
> lifecycle that is much longer. Is there an argument for an LTS Yocto
> release, maybe once a year? If not, what is the recommended way for a
> project developer to keep a distribution up to date in the light of the
> several well-publicised security flaws that have been discovered over
> the last year or so and the new ones that will no doubt be discovered in
> the future?

At table of the current supported release can be found at
https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance

- Armin

> 
> Regards,
> Chris Simmonds
> 

Re: RFC: Yocto LTS?

[Chris Simmonds]

Hi,

On 14/10/15 14:50, akuster808 wrote:
> Chris,
> 
> 
> On 10/14/2015 06:28 AM, Chris Simmonds wrote:
>> Hi,
>>
>> Is there a statement about the period of support for a Yocto release?
>> Looking through the updates, it seems that 12 months is typical, a was
>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>> declaration anywhere that this is the expected norm.
> 
> There is a release every 6 months.
> 
> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_release_cycle_of_the_Yocto_Project.3F
> 
>>
>> Leading on from that, is 12 months enough? Most projects have a
>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>> release, maybe once a year? If not, what is the recommended way for a
>> project developer to keep a distribution up to date in the light of the
>> several well-publicised security flaws that have been discovered over
>> the last year or so and the new ones that will no doubt be discovered in
>> the future?
> 
> At table of the current supported release can be found at
> https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance
> 
> - Armin
>

Thanks, Armin, that is the kind of thing I was looking for. It doesn't
mention a timespan for updates, but there does seem to be an implicit
maintenance period of 12 months after release. I am still worried that
this is a rather short period of time, though, and encourages device
manufacturers to avoid ever updating boxes in the field.

>>
>> Regards,
>> Chris Simmonds
>>
> 

Re: RFC: Yocto LTS?

[Bruce Ashfield]

On 15-10-14 11:12 AM, Chris Simmonds wrote:
> Hi,
>
> On 14/10/15 14:50, akuster808 wrote:
>> Chris,
>>
>>
>> On 10/14/2015 06:28 AM, Chris Simmonds wrote:
>>> Hi,
>>>
>>> Is there a statement about the period of support for a Yocto release?
>>> Looking through the updates, it seems that 12 months is typical, a was
>>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>>> declaration anywhere that this is the expected norm.
>>
>> There is a release every 6 months.
>>
>> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_release_cycle_of_the_Yocto_Project.3F
>>
>>>
>>> Leading on from that, is 12 months enough? Most projects have a
>>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>>> release, maybe once a year? If not, what is the recommended way for a
>>> project developer to keep a distribution up to date in the light of the
>>> several well-publicised security flaws that have been discovered over
>>> the last year or so and the new ones that will no doubt be discovered in
>>> the future?
>>
>> At table of the current supported release can be found at
>> https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance
>>
>> - Armin
>>
>
> Thanks, Armin, that is the kind of thing I was looking for. It doesn't
> mention a timespan for updates, but there does seem to be an implicit
> maintenance period of 12 months after release. I am still worried that
> this is a rather short period of time, though, and encourages device
> manufacturers to avoid ever updating boxes in the field.

For longer term support, or for support of truly critical devices, the
Yocto project has relied on OSVs to offer commercial support for their
Yocto compatible distributions.

For the project itself, and the projects under the umbrella, the
developer capacity to maintain and support a release for longer than a
year simply doesn't exist. And that lack of cycles is only from the
point of view of duration, much less to offer something that looks
like a SLA on critical issues.

Cheers,

Bruce




>
>>>
>>> Regards,
>>> Chris Simmonds
>>>
>>
>

Re: RFC: Yocto LTS?

[Mark Hatle]

On 10/14/15 8:28 AM, Chris Simmonds wrote:
> Hi,
> 
> Is there a statement about the period of support for a Yocto release?
> Looking through the updates, it seems that 12 months is typical, a was
> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
> declaration anywhere that this is the expected norm.
> 
> Leading on from that, is 12 months enough? Most projects have a
> lifecycle that is much longer. Is there an argument for an LTS Yocto
> release, maybe once a year? If not, what is the recommended way for a
> project developer to keep a distribution up to date in the light of the
> several well-publicised security flaws that have been discovered over
> the last year or so and the new ones that will no doubt be discovered in
> the future?

https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_overall_support_plan_for_the_Yocto_Project.3F

=What is the release cycle of the Yocto Project?=
Each release of the Yocto Project is subject to its own release schedule
according to the community-maintained Project Planning Guide. It is generally
expected that a new version of the Yocto Project will be released every six months.

=What is the overall support plan for the Yocto Project?=
Security patches and critical bug fixes are supplied one release back. No
toolchain or kernel changes are allowed for these updates. Support for longer
periods of time can be supplied by commercial OSVs.



Effectively this means that support is on the last two releases.  Releases are
typically released every 6 months.  After that point it is usually supported by
OSVs, or others that offer commercial services.  In the past we have done a few
very late security fixes past the 'last two releases' point, however that has
been for unique situations.

You should consider keeping current with the Yocto Project releases or consider
commercial support if you need more then an approx 12 - 18 month support cycle.

--Mark

> Regards,
> Chris Simmonds
> 

Re: RFC: Yocto LTS?

[Chris Simmonds]

On 14/10/15 17:27, Mark Hatle wrote:
> On 10/14/15 8:28 AM, Chris Simmonds wrote:
>> Hi,
>>
>> Is there a statement about the period of support for a Yocto release?
>> Looking through the updates, it seems that 12 months is typical, a was
>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>> declaration anywhere that this is the expected norm.
>>
>> Leading on from that, is 12 months enough? Most projects have a
>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>> release, maybe once a year? If not, what is the recommended way for a
>> project developer to keep a distribution up to date in the light of the
>> several well-publicised security flaws that have been discovered over
>> the last year or so and the new ones that will no doubt be discovered in
>> the future?
> 
> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_overall_support_plan_for_the_Yocto_Project.3F
> 
> =What is the release cycle of the Yocto Project?=
> Each release of the Yocto Project is subject to its own release schedule
> according to the community-maintained Project Planning Guide. It is generally
> expected that a new version of the Yocto Project will be released every six months.
> 
> =What is the overall support plan for the Yocto Project?=
> Security patches and critical bug fixes are supplied one release back. No
> toolchain or kernel changes are allowed for these updates. Support for longer
> periods of time can be supplied by commercial OSVs.
> 
> 
> 
> Effectively this means that support is on the last two releases.  Releases are
> typically released every 6 months.  After that point it is usually supported by
> OSVs, or others that offer commercial services.  In the past we have done a few
> very late security fixes past the 'last two releases' point, however that has
> been for unique situations.
> 
> You should consider keeping current with the Yocto Project releases or consider
> commercial support if you need more then an approx 12 - 18 month support cycle.
> 
> --Mark
> 

Thanks, that is all clear now.

Chris

Re: RFC: Yocto LTS?

[Philip Balister]

On 10/14/2015 12:26 PM, Chris Simmonds wrote:
> 
> On 14/10/15 17:27, Mark Hatle wrote:
>> On 10/14/15 8:28 AM, Chris Simmonds wrote:
>>> Hi,
>>>
>>> Is there a statement about the period of support for a Yocto release?
>>> Looking through the updates, it seems that 12 months is typical, a was
>>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>>> declaration anywhere that this is the expected norm.
>>>
>>> Leading on from that, is 12 months enough? Most projects have a
>>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>>> release, maybe once a year? If not, what is the recommended way for a
>>> project developer to keep a distribution up to date in the light of the
>>> several well-publicised security flaws that have been discovered over
>>> the last year or so and the new ones that will no doubt be discovered in
>>> the future?
>>
>> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_overall_support_plan_for_the_Yocto_Project.3F
>>
>> =What is the release cycle of the Yocto Project?=
>> Each release of the Yocto Project is subject to its own release schedule
>> according to the community-maintained Project Planning Guide. It is generally
>> expected that a new version of the Yocto Project will be released every six months.
>>
>> =What is the overall support plan for the Yocto Project?=
>> Security patches and critical bug fixes are supplied one release back. No
>> toolchain or kernel changes are allowed for these updates. Support for longer
>> periods of time can be supplied by commercial OSVs.
>>
>>
>>
>> Effectively this means that support is on the last two releases.  Releases are
>> typically released every 6 months.  After that point it is usually supported by
>> OSVs, or others that offer commercial services.  In the past we have done a few
>> very late security fixes past the 'last two releases' point, however that has
>> been for unique situations.
>>
>> You should consider keeping current with the Yocto Project releases or consider
>> commercial support if you need more then an approx 12 - 18 month support cycle.
>>
>> --Mark
>>
> 
> Thanks, that is all clear now.

We wouldn't be opposed to a group of people supporting a release for
longer. But they would need to provide the people to do the work. LTS
work is hard.

Philip

> 
> Chris
> 

Re: RFC: Yocto LTS?

[Chris Simmonds]

On 15/10/15 16:49, Philip Balister wrote:
> On 10/14/2015 12:26 PM, Chris Simmonds wrote:
>>
>> On 14/10/15 17:27, Mark Hatle wrote:
>>> On 10/14/15 8:28 AM, Chris Simmonds wrote:
>>>> Hi,
>>>>
>>>> Is there a statement about the period of support for a Yocto release?
>>>> Looking through the updates, it seems that 12 months is typical, a was
>>>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>>>> declaration anywhere that this is the expected norm.
>>>>
>>>> Leading on from that, is 12 months enough? Most projects have a
>>>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>>>> release, maybe once a year? If not, what is the recommended way for a
>>>> project developer to keep a distribution up to date in the light of the
>>>> several well-publicised security flaws that have been discovered over
>>>> the last year or so and the new ones that will no doubt be discovered in
>>>> the future?
>>>
>>> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_overall_support_plan_for_the_Yocto_Project.3F
>>>
>>> =What is the release cycle of the Yocto Project?=
>>> Each release of the Yocto Project is subject to its own release schedule
>>> according to the community-maintained Project Planning Guide. It is generally
>>> expected that a new version of the Yocto Project will be released every six months.
>>>
>>> =What is the overall support plan for the Yocto Project?=
>>> Security patches and critical bug fixes are supplied one release back. No
>>> toolchain or kernel changes are allowed for these updates. Support for longer
>>> periods of time can be supplied by commercial OSVs.
>>>
>>>
>>>
>>> Effectively this means that support is on the last two releases.  Releases are
>>> typically released every 6 months.  After that point it is usually supported by
>>> OSVs, or others that offer commercial services.  In the past we have done a few
>>> very late security fixes past the 'last two releases' point, however that has
>>> been for unique situations.
>>>
>>> You should consider keeping current with the Yocto Project releases or consider
>>> commercial support if you need more then an approx 12 - 18 month support cycle.
>>>
>>> --Mark
>>>
>>
>> Thanks, that is all clear now.
> 
> We wouldn't be opposed to a group of people supporting a release for
> longer. But they would need to provide the people to do the work. LTS
> work is hard.
> 
> Philip
> 
>>
>> Chris
>>
> 

Indeed, it is hard work. But there is a community out there with the
expertise and many very profitable corporations that depend on Yocto
Project (in addition to Intel, I mean, since they put a lot of resource
in already). It would be really nice if someone neutral - Linux
Foundation for example - could bring them together to make LTS work for
everybody.

Chris.

Re: RFC: Yocto LTS?

[akuster]

On 10/15/15 8:49 AM, Philip Balister wrote:
> On 10/14/2015 12:26 PM, Chris Simmonds wrote:
>>
>> On 14/10/15 17:27, Mark Hatle wrote:
>>> On 10/14/15 8:28 AM, Chris Simmonds wrote:
>>>> Hi,
>>>>
>>>> Is there a statement about the period of support for a Yocto release?
>>>> Looking through the updates, it seems that 12 months is typical, a was
>>>> the case for 1.4, 1.5 and 1.6 for example, but I cannot see a
>>>> declaration anywhere that this is the expected norm.
>>>>
>>>> Leading on from that, is 12 months enough? Most projects have a
>>>> lifecycle that is much longer. Is there an argument for an LTS Yocto
>>>> release, maybe once a year? If not, what is the recommended way for a
>>>> project developer to keep a distribution up to date in the light of the
>>>> several well-publicised security flaws that have been discovered over
>>>> the last year or so and the new ones that will no doubt be discovered in
>>>> the future?
>>>
>>> https://wiki.yoctoproject.org/wiki/FAQ#What_is_the_overall_support_plan_for_the_Yocto_Project.3F
>>>
>>> =What is the release cycle of the Yocto Project?=
>>> Each release of the Yocto Project is subject to its own release schedule
>>> according to the community-maintained Project Planning Guide. It is generally
>>> expected that a new version of the Yocto Project will be released every six months.
>>>
>>> =What is the overall support plan for the Yocto Project?=
>>> Security patches and critical bug fixes are supplied one release back. No
>>> toolchain or kernel changes are allowed for these updates. Support for longer
>>> periods of time can be supplied by commercial OSVs.
>>>
>>>
>>>
>>> Effectively this means that support is on the last two releases.  Releases are
>>> typically released every 6 months.  After that point it is usually supported by
>>> OSVs, or others that offer commercial services.  In the past we have done a few
>>> very late security fixes past the 'last two releases' point, however that has
>>> been for unique situations.
>>>
>>> You should consider keeping current with the Yocto Project releases or consider
>>> commercial support if you need more then an approx 12 - 18 month support cycle.
>>>
>>> --Mark
>>>
>>
>> Thanks, that is all clear now.
> 
> We wouldn't be opposed to a group of people supporting a release for
> longer. But they would need to provide the people to do the work. LTS
> work is hard.

Not to mention keeping build infrastructure setup, copies of supported
OS working, QA and Target machines working. As an OSV, its not uncommon
to support a distro for 10 or more years.

- Armin
> 
> Philip
> 
>>
>> Chris
>>