Problems understanding cvs and update concept

[Thomas Nyman <thomas_(_at_)_teg_(_dot_)_pp_(_dot_)_se>]

Hi

I am new to openbsd, but have experience with primarily debian.

I have managed to install and get my openbsd 3.5 machine running, i can 
install packages and i can update my cvs tree and ports tree. I can 
install a new generic kernel and update my binaries.

However i have been unable to find good information about opensbsd and 
how to keep the system updated. That said i realize ofcourse that when i 
update my cvs source and update my binaries my system is updated.

But the thing that puzzles me is whether or not this is the only method.

I have a system that onlu contains my bare minimum. I have not installed 
packages that i do not need (naturally). On the errata page i can follow 
new errata but i find it difficult to comprehend how to use this 
effectivly. Perhaps an example will show my ignorance :)

Today if i look at the errat/patches page for 3.5 i can see the following

023: RELIABILITY FIX: November 10, 2004
Due to a bug in lynx(1) it is possible for pages such as this to cause 
lynx(1) to exhaust memory and then crash when parsing such pages.
A source code patch exists which remedies this problem.

Lets say i want to now if this reliability fix is needed for my version 
of lynx.

If i do pkg_info -a it looks like lynx is not installed - which it is.

If i do "whereis lynx" I get /usr/bin/lynx

a lynx --version gives me Lynx Version 2.8.4rel.1

I do not understand why pkg_info does not tell me that Lynx is installed 
since it is. I will admit that I do not remember if I installed it as a 
port or not. However I digress. Now I know which version of Lynx I have. 
How can I tell if I need to apply the reliability fix?

In fact what is the guiding principle behind keeping an openbsd system 
updated? Today I run an cvs update, generate new generic kernel and then 
update the binaries. All of which takes some time. Is this the way its 
supposed to be done? What happens with installed ports, are they also 
update when I update binaries via cvs ( i suspect not). And if not how 
should one handle a system that has some ports installed in the context 
of keeping it updated?

Since english is not my first language its possible that i'm not being 
concise in my description. But to sum it up - if i wish to keep my 
system updated what is the best way with respects to both ports and 
packages? an alas.. how can i find out what is installed on my system? 
why does pkg_info not display everyting that is installed? I am sure 
that for the initiated my questions seem stupid but I have not been able 
to find a good overall description that explains how things are 
connected in this respect.

Hoping for a helpful hand

Thomas