Are there any guidelines when to use %config and when %config (noreplace)? If you look at this bug report: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158568 Currently in FC-3 the ca-bundle.pem file is not %config at all. This is obviously wrong because if sysadmin changes this file (and it's legitimate to do so) he will lose his changes after openssl update. However it's questionable if it should be %config(noreplace) because then he will not get the changes (new CA certificates) on update. -- Tomas Mraz <tmraz@xxxxxxxxxx>