OraTransplant

Our patch and upgrade policy

Eurotransplant allocates organs available for donation in 6 European countries. Whenever an organ donor is available in any of these six countries, Eurotransplant is notified. We collect data about that donor and start the matching to all recipients on the waiting list. This process relies heavily on IT. It’s also a very time critical process and has to be available 24×7, as you can imagine. It can be a matter of life and death for the recipients on the waiting list. That’s why we cannot take a lot of risks with installing new patches and upgrades to our (Oracle) software.

We release a new version of our system every 1.5 to 2 months. During that period, changes to the system are continuously tested. Developers finish the release at least one week before the release date. That last week is used for final testing of all critical components.

With this in mind, we defined our policy for patches and upgrades to the Oracle software. Let’s start with one-off patches. Upgrade and patch sets have to be installed on the test and development environments before the start of the next development cycle. If all goes well, the upgrade or patch set is installed on production at the end of the release cycle, when the new release goes live. So, all tests and the final critical test are done with the patch set or upgrade in place.

Larger upgrades might take even longer and will have separate test environments. A good example was our recent upgrade from database 8.1.7 to 10.2.0. Developing and testing this upgrade was so much work that is was done outside the normal development cycles.

We’re a bit more flexible with installing one-off patches. These patches are limited in scope and thus less risky than full upgrade or patch sets. Also, these tend to be more time critical since they target specific bugs we’re suffering from. A one-off patch also gets installed on test/development first. It doesn’t really matter when it’s installed as long as it is before the start of the final week of critical tests. That way the one-off patch can be installed on the production environment with the next release.

In very exceptional circumstances we can decide to install a one-off patch on production outside normal release dates. But we would only do that if we’re hitting a truly critical bug.

CPU Jan2006 for Database 10.2.0.1 on Linux re-issued

Here we go again! Just got an email from Oracle that Critical Patch Update January 2006 for Database 10.2.0.1 running on Linux x86 was re-issued. I think they re-issued some part of each Critical Patch Update since they started with the things. Is it so hard to test all known vulnerabilities after applying the patch sets in the final stage of QA?

Will they ever get it right the first time?

Dear Oracle Customer,

You are receiving this email because our records indicated you downloaded
the Critical Patch Update January 2006 (CPUJan2006) patch for Oracle
Database 10.2.0.1 (Patch 4751931)for Linux x86 before it was re-uploaded on
January 20, 2006.

These patches were re-uploaded because some files did not include all of the
changes required to fix the security vulnerabilities being addressed in the
January 2006 Critical Patch Update. No functional problems will be
encountered by applying an earlier version of these patches, but some
security vulnerabilities will not be completely fixed. Even if you have
successfully applied an earlier version of these patches, you should still
re-download and re-apply the latest version of the patches, dated
20-JAN-2006.

Please accept our apologies for any inconvenience you may have experienced,
and we thank you for your patience and cooperation in securing your Oracle
server products.

Regards,
Oracle Global Product Security

P.S. Please use MetaLink, https://metalink.oracle.com, to submit a Service
Request If you require further assistance. Please do not reply to this
email.

Database 10gR2 up for download

We all knew it was coming, but Oracle just release the next version of their flagship: Database 10g Release 2 (v10.2.0.1.0). For now its just available for Linux, but I guess they will be adding other major platforms very soon.

I couldn’t find any certification information about combinations with the different AppServers yet.