OS patching via cfengine

[Ryan Anderson]

I'm trying to roll out OS patches to Solaris & IRIX hosts, but can't
think of a way via cfengine besides making a cfengine script that
executes a self-made shell script via shellcommands. I would like to do
as much as possible using cfengine built-ins. Here are the design
considerations I can think of:

- Should be able to check against a listing of patches, then apply only
the patches that are newer than the ones it already has
- The listing of patches to apply should be generated dynamically based
on whether a patch is in a central patch directory (so the cfengine
script doesn't need to be constantly updated for each new patch)
- Patches would reside in a central location that should be mounted
manually; ie not all hosts are in a NIS domain with an automount
location to pull from. I'd be open to using a 'copy' of all patches to
every host if this is a better design way to go

Has anyone 'invented the wheel' on this one already and willing to
share ideas or code?


Thanks,


RCA
--
Ryan C. Anderson
Unix Administrator
United Defense L.P.
desk   763.572.6684
pager  952.235.9936
mobile 612.419.9362