[Starlingx-discuss] Recent download_mirror issue developer vs cengn

[Saul Wold]

On 6/12/20 1:26 PM, Scott Little wrote:
> What arguments where use for download_mirror.sh ?
> 
None, as far as I can tell from the history in the shell for the 
container. That's why I said "default settings" below, sorry if that was 
not clear.

Sau!

> Scott
> 
> 
> On 2020-06-12 4:15 p.m., Saul Wold wrote:
>>
>> Folks (particularly Scott and Davlet):
>>
>> There was a recent issues with a developer in India (Poornima) doing 
>> the CVE updates for expat and gettext. When she used the 
>> download_mirrors script with the default settings (which is 
>> appropriate), it used the /etc/yum.repos.d setup of repo lists. The 
>> CentOS-Base.repo points to a set of mirrorlists, not to the 
>> mirror.centos.org directly.  So when yumdownloader started looking it 
>> found the local to India mirrors and the Centos7 repo which was 
>> updated with the newer versions.
>>
>> From the logs on her build machine I can see this:
>> url_srpm:http://centos.mirrors.estointernet.in/7.8.2003/os/x86_64/Packages/expat-devel-2.1.0-11.el7.x86_64.rpm 
>>
>>
>> Notice it's using 7.8 even though is not explicitly mentioned in 
>> default repo lists. So yumdownloader is searching though the 
>> mirrorlist and finding the 7.8 repo above and beyond the set we would 
>> normally default to.
>>
>> What I am not sure about is how Cengn does the mirroring process, I 
>> think it uses download_mirror with the default /etc/yum.repos.d, but I 
>> can't be sure.
>>
>> I need Scott and Davlet to weigh here until I can get better access to 
>> Jenkins or recreate a Jenkins instance.
>>
>> Sau!