[Starlingx-discuss] Recent download_mirror issue developer vs cengn
Folks (particularly Scott and Davlet): There was a recent issues with a developer in India (Poornima) doing the CVE updates for expat and gettext. When she used the download_mirrors script with the default settings (which is appropriate), it used the /etc/yum.repos.d setup of repo lists. The CentOS-Base.repo points to a set of mirrorlists, not to the mirror.centos.org directly. So when yumdownloader started looking it found the local to India mirrors and the Centos7 repo which was updated with the newer versions. From the logs on her build machine I can see this: url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-deve... Notice it's using 7.8 even though is not explicitly mentioned in default repo lists. So yumdownloader is searching though the mirrorlist and finding the 7.8 repo above and beyond the set we would normally default to. What I am not sure about is how Cengn does the mirroring process, I think it uses download_mirror with the default /etc/yum.repos.d, but I can't be sure. I need Scott and Davlet to weigh here until I can get better access to Jenkins or recreate a Jenkins instance. Sau!
What arguments where use for download_mirror.sh ? Scott On 2020-06-12 4:15 p.m., Saul Wold wrote:
Folks (particularly Scott and Davlet):
There was a recent issues with a developer in India (Poornima) doing the CVE updates for expat and gettext. When she used the download_mirrors script with the default settings (which is appropriate), it used the /etc/yum.repos.d setup of repo lists. The CentOS-Base.repo points to a set of mirrorlists, not to the mirror.centos.org directly. So when yumdownloader started looking it found the local to India mirrors and the Centos7 repo which was updated with the newer versions.
From the logs on her build machine I can see this: url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-deve...
Notice it's using 7.8 even though is not explicitly mentioned in default repo lists. So yumdownloader is searching though the mirrorlist and finding the 7.8 repo above and beyond the set we would normally default to.
What I am not sure about is how Cengn does the mirroring process, I think it uses download_mirror with the default /etc/yum.repos.d, but I can't be sure.
I need Scott and Davlet to weigh here until I can get better access to Jenkins or recreate a Jenkins instance.
Sau!
On 6/12/20 1:26 PM, Scott Little wrote:
What arguments where use for download_mirror.sh ?
None, as far as I can tell from the history in the shell for the container. That's why I said "default settings" below, sorry if that was not clear. Sau!
Scott
On 2020-06-12 4:15 p.m., Saul Wold wrote:
Folks (particularly Scott and Davlet):
There was a recent issues with a developer in India (Poornima) doing the CVE updates for expat and gettext. When she used the download_mirrors script with the default settings (which is appropriate), it used the /etc/yum.repos.d setup of repo lists. The CentOS-Base.repo points to a set of mirrorlists, not to the mirror.centos.org directly. So when yumdownloader started looking it found the local to India mirrors and the Centos7 repo which was updated with the newer versions.
From the logs on her build machine I can see this: url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-deve...
Notice it's using 7.8 even though is not explicitly mentioned in default repo lists. So yumdownloader is searching though the mirrorlist and finding the 7.8 repo above and beyond the set we would normally default to.
What I am not sure about is how Cengn does the mirroring process, I think it uses download_mirror with the default /etc/yum.repos.d, but I can't be sure.
I need Scott and Davlet to weigh here until I can get better access to Jenkins or recreate a Jenkins instance.
Sau!
participants (2)
-
Saul Wold
-
Scott Little