[Starlingx-discuss] Recent download_mirror issue developer vs cengn

[Scott Little]

What arguments where use for download_mirror.sh ?

Scott


On 2020-06-12 4:15 p.m., Saul Wold wrote:
>
> Folks (particularly Scott and Davlet):
>
> There was a recent issues with a developer in India (Poornima) doing 
> the CVE updates for expat and gettext. When she used the 
> download_mirrors script with the default settings (which is 
> appropriate), it used the /etc/yum.repos.d setup of repo lists. The 
> CentOS-Base.repo points to a set of mirrorlists, not to the 
> mirror.centos.org directly.  So when yumdownloader started looking it 
> found the local to India mirrors and the Centos7 repo which was 
> updated with the newer versions.
>
> From the logs on her build machine I can see this:
> url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-devel-2.1.0-11.el7.x86_64.rpm 
>
>
> Notice it's using 7.8 even though is not explicitly mentioned in 
> default repo lists. So yumdownloader is searching though the 
> mirrorlist and finding the 7.8 repo above and beyond the set we would 
> normally default to.
>
> What I am not sure about is how Cengn does the mirroring process, I 
> think it uses download_mirror with the default /etc/yum.repos.d, but I 
> can't be sure.
>
> I need Scott and Davlet to weigh here until I can get better access to 
> Jenkins or recreate a Jenkins instance.
>
> Sau!