[Starlingx-discuss] Recent download_mirror issue developer vs cengn
Saul Wold
sgw at linux.intel.com
Fri Jun 12 20:15:34 UTC 2020
Folks (particularly Scott and Davlet):
There was a recent issues with a developer in India (Poornima) doing the
CVE updates for expat and gettext. When she used the download_mirrors
script with the default settings (which is appropriate), it used the
/etc/yum.repos.d setup of repo lists. The CentOS-Base.repo points to a
set of mirrorlists, not to the mirror.centos.org directly. So when
yumdownloader started looking it found the local to India mirrors and
the Centos7 repo which was updated with the newer versions.
From the logs on her build machine I can see this:
url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-devel-2.1.0-11.el7.x86_64.rpm
Notice it's using 7.8 even though is not explicitly mentioned in default
repo lists. So yumdownloader is searching though the mirrorlist and
finding the 7.8 repo above and beyond the set we would normally default to.
What I am not sure about is how Cengn does the mirroring process, I
think it uses download_mirror with the default /etc/yum.repos.d, but I
can't be sure.
I need Scott and Davlet to weigh here until I can get better access to
Jenkins or recreate a Jenkins instance.
Sau!
More information about the Starlingx-discuss
mailing list