Solaris 10 05/08 (Update 5) Patch Bundle
By Gerry Haskins on Jun 09, 2008
Last week, the Solaris 10 05/08 (Update 5) Patch Bundle was released on SunSolve. The patch bundle provides another option to customers when deciding their patching strategy to maintain their Solaris systems.
What is the Solaris 10 05/08 Patch Bundle ?
The Solaris 10 05/08 Patch Bundle contains the equivalent set of patches contained in the Solaris 10 05/08 (Update 5) release image.
Why use the Solaris 10 05/08 Patch Bundle ?
The Solaris 10 05/08 Patch Bundle was created as a result of direct customer feedback after the Solaris 10 08/07 (Update 4) release. New hardware may require a specific minimum Solaris 10 Update release such as the Solaris 10 05/08 (Update 5) release. Some customers may wish to bring their other existing Solaris 10 systems up to the same patch level as the new hardware running Solaris 10 05/08. The recommended way to do this is to upgrade the existing systems to the Solaris 10 05/08 release using either regular Solaris Upgrade or Solaris Live Upgrade. But some customers may have policies in place which make it difficult to upgrade but OK to patch a system. The Solaris 10 05/08 Patch Bundle facilitates such customers to bring their existing systems up to the equivalent patch level to the Solaris 10 05/08 (Update 5) Release. In theory, this should mean that pre-existing functionality on all of the customers' systems should react the same, warts and all. This makes for a more homogeneous environment which may help lower support costs.
The Solaris 10 Update releases are very intensely tested by a wide variety of QA teams within Sun. Therefore, the functionality contained in the patches within the Solaris 10 05/08 Patch Bundle have been intensely tested as a unit through the testing performed on the Solaris 10 05/08 (Update 5) release image. Additional testing of the Solaris 10 05/08 Patch Bundle has also been performed by the Patch System Test team. Therefore, the Solaris 10 05/08 Patch Bundle provides a well tested "baseline" option on which to standardize systems.
So while the patch bundle may deliver more change than some other patching strategies, that change has been well tested as a unit and hence may actually reduce the risk of introducing regressions when compared to "dim sum" patching (i.e. choosing an arbitrary combination of patches). Note that intensive processes are also in place to ensure "dim sum" patching works, and it's rare to encounter a problem caused by "dim sum" patching.
How does the Patch Bundle differ from the Solaris 10 05/08 (Update 5) release image ?
The Solaris 10 05/08 (Update 5) release is a complete Solaris release image. It contains new packages to support new features in the Solaris 10 05/08 (Update 5) release as well as all Solaris patches which were available when the Update was built. The patches are pre-applied into the Solaris 10 05/08 release image. This means that one doesn't have to spend time adding the patches using 'patchadd'. On the flipside, since the patches are pre-applied into the release image, they cannot be backed out using 'patchrm'. This isn't generally a problem as the Solaris Update release images are very intensely tested. One can do a fresh install of the Solaris 10 05/08 (Update 5) release, or upgrade to it from an earlier Solaris release.
The Solaris 10 05/08 Patch Bundle contains the equivalent set of patches to the Solaris 10 05/08 (Update 5) release. The patch bundle does not include the new packages contained in the Solaris 10 05/08 (Update 5) release. Therefore, new features in Update 5 which depend upon new packages introduced in that release will not be available in the patch bundle. However, as discussed in a previous blog entry, any change to pre-existing code is delivered in a patch. This includes features as well as bug fixes. Therefore some feature enhancements will be available in the patch bundle. ZFS, for example, is typically self-contained in patches and hence ZFS enhancements will typically be available via the patch bundle as well as via the Update release image. So will most Zones enhancements. The patch bundle is simply a collection of patches with an install order file (patch_order) and an install script wrapper (installbundle.sh) around 'patchadd'. Patches in the patch bundle can be backed out using 'patchrm', so long as the '-d' (no save) option wasn't used when applying the patch bundle.
There are a number of "special" or "script" patches included in each Solaris Update release. These patches are used to correct issues in how patches are pre-applied into the Solaris Update release image and have no purpose whatsoever outside of the Solaris Update release process. Therefore, these "special" or "script" patches are not released to SunSolve and are not included in the patch bundle. See the Solaris 10 05/08 Patch Bundle README file for further information on these and other minor differences between the patch set pre-applied in the Solaris 10 05/08 release image and the patch set included in the Solaris 10 05/08 Patch Bundle.
The Solaris 10 05/08 Patch Bundle is available from the usual patch cluster location.
Log onto Sunsolve, click on Patches and Updates, then Recommended Patch Clusters and scroll down the box under "Recommended Solaris Patch Clusters, J2SE and Java Enterprise System Clusters" to the Solaris 10 SPARC 05/08 Patch Bundle and Solaris 10 x86 05/08 Patch Bundle entries.
The cluster is chunked to aid download. There are 2 chunks for x86 and 3 chunks for SPARC.
Follow the download instructions to the right of the scroll-down box or read the README file for any chunk.
As with all patch clusters, you need a valid support contract to download the cluster. The following support contracts include access entitlement to Solaris patches and Patch Clusters (BTW: Software
Update = patch), plus a wide range of additional support services: Solaris Subscriptions, which includes Basic, Standard, Premium, and Solaris Everywhere Service
Plans (compare here); Sun Software Service Plans, including Basic, Standard, Premium, and Premium Plus; Sun System Service Plans for Solaris, which includes Bronze, Silver, Gold, or Platinum options (compare here); or a
Sun Spectrum Enterprise Service Plan. See also http://www.sun.com/servicelist/ for country specific details.
Read the Patch Bundle README file for full installation instructions.
The patch bundle can be installed either on the active boot environment (i.e. the live system) or an inactive boot environment.
Patching an inactive boot environment is recommended as, depending on the starting patch level of the target system, it may involve less system downtime as only a single reboot is required at the end to activate the boot environment.
If you patch the active boot environment (i.e. the live system), then depending on the starting patch level of the target system, you may need to reboot an x86 system up to three times (twice at specific points during the installation process and once at the end) and a SPARC system up to two times (once after installing Kernel patch 118833-36 and once at the end). See the patch bundle README for details.
The Solaris 10 05/08 Patch Bundle includes a new install script, installbundle.sh, which guides users through the installation process.
The patches are ordered in such a way as to process any reboots required when patching an active boot environment as near the start of the installation process as possible. This is to facilitate System Administrators by allowing them to get over the interim reboots early in the process and kick off the final patching sequence and let the process complete.
The screen output and logfiles produced are also designed to be as clear and self-explanatory as possible, providing both overview and drill-down capabilities.
Approximate Installation Time
How long it will take to install the Solaris 10 05/08 Patch Bundle will depend upon a number of factors:
- The speed of the hardware and its I/O.
- Which Solaris 10 release is installed on the target system and what patch level the system is at. The higher the Solaris 10 Update release or patch level, the quicker the patch bundle will apply.
- Whether Zones are installed on the system and which type of Zone. Currently, the time to apply the cluster to each whole root non-global Zone will be approximately linear - i.e. multiple the install time by the number of whole root non-global Zones on the system. Sparse root non-global Zones will be a little faster. (BTW: Sparse root non-global Zones is the recommended option when creating non-global Zones.) As mentioned in a previous blog posting, there is a project in development to improve Zones patching performance.
For example, I installed the Solaris 10 x86 05/08 Patch Bundle on a v65x running the original Solaris 10 3/05 "FCS" (First Customer Shipment) release with no additional patch applied (worst case) and no non-global Zones. I applied the patch bundle to the active boot environment. Installation took a total of 3 hours and 58 minutes plus 3 reboots (see the Patch Bundle README for an explanation of the reboots when patching an active boot environment).
The Solaris 10 05/08 Patch Bundle will not suit everyone. It is a large collection of patches and hence is slow to download and install.
As described in a previous blog posting, the Sun Alert patch clusters (available from the same location on SunSolve - see above) provide the minimum amount of change to address the most critical Solaris issues. The Sun Alert cluster contains all available Solaris patch fixes for Security, Data Corruption, and System Availability issues. New versions of the Sun Alert cluster are posted whenever a new patch to fix a Sun Alert issue becomes available. Customers should try to keep as current as possible with the contents of the Sun Alert clusters.
For customers who want to bring all their systems to the Solaris 10 05/08 (Update 5) release patch level, installing or upgrading to the Solaris 10 05/08 (Update 5) Release image remains the recommended option where feasible. The Solaris 10 05/08 Patch Bundle was simply created in response to a demand from customers for an alternative option where upgrading was not feasible due to internal customer policies.
Since Solaris Update releases are intensely tested, the patch bundle provides a good quality patch "baseline" on which to standardize systems.
From customer feedback to date, the next Patch Bundle for the equivalent set of patches for Update 6 is likely to also be a complete set of patches from Solaris 10 3/05 "FCS" (First Customer Shipment - i.e. the original Solaris 10 release) and not an incremental bundle just containing the patch set delta between Updates 5 and 6 as I had previously suggested. Feel free to post a comment with your preference.