[Starlingx-discuss] Recent download_mirror issue developer vs cengn

Saul Wold sgw at linux.intel.com
Fri Jun 12 20:15:34 UTC 2020


Folks (particularly Scott and Davlet):

There was a recent issues with a developer in India (Poornima) doing the 
CVE updates for expat and gettext. When she used the download_mirrors 
script with the default settings (which is appropriate), it used the 
/etc/yum.repos.d setup of repo lists.  The CentOS-Base.repo points to a 
set of mirrorlists, not to the mirror.centos.org directly.  So when 
yumdownloader started looking it found the local to India mirrors and 
the Centos7 repo which was updated with the newer versions.

 From the logs on her build machine I can see this:
url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-devel-2.1.0-11.el7.x86_64.rpm

Notice it's using 7.8 even though is not explicitly mentioned in default 
repo lists. So yumdownloader is searching though the mirrorlist and 
finding the 7.8 repo above and beyond the set we would normally default to.

What I am not sure about is how Cengn does the mirroring process, I 
think it uses download_mirror with the default /etc/yum.repos.d, but I 
can't be sure.

I need Scott and Davlet to weigh here until I can get better access to 
Jenkins or recreate a Jenkins instance.

Sau!



More information about the Starlingx-discuss mailing list