Comment 69 for bug 913230

(In reply to comment #67)
> (In reply to comment #41)
> > The problem with this change is it will use any activated media, including
> > third party media and backports. This is too risky. The need is not for updates
> > to pull dependencies from anywhere, only from release media.
> >
> > Sorry to kill hopes :)
>
> If people don't want to install packages from a media, then they should not
> activate that media.
>
> The patch from #c40 seems correct to me. Before the patch, MageiaUpdate :
> - tag as searchmedia all update media
> - load synthesis from update media only
> - use searchmedia medias to find update candidates
> - resolve dependencies for update candidates using all loaded synthesis

[...]

> MageiaUpdate could be patched to use only medias listed as "updates_for" in
> media.cfg, but that seems wrong :
> - this info is only available in media.cfg, and not everybody is using
> media.cfg to add their medias

This i didn't know... and that sort of changes things, it even increases the complexity by a whole lot.

Lastly, since we need to have stricter requires anyway, even for backports this patch shouldn't be a problem.

I would prefer this patch to be applied soon-ish, so that it actually fixes bug 2317. it's a simple fix, so there's less stuff that can go wrong. and so we can actually also apply it for our stable releases... thereby lessening the burden of QA team, which is the whole reason of this bug anyway.