On 2/24/23 12:01 PM, Chris Adams wrote:
Once upon a time, Robert Marcano via devel <devel@xxxxxxxxxxxxxxxxxxxxxxx> said:
Does DNF on RHEL for example do something different when --security
is involved? Because the RHEL documentation talks about it as a
feature to use. Is a lack of metadata for previous updates the
problem or the implementation?
Just a guess, but... updates in RHEL are different from updates in
Fedora because of policy. In RHEL, updates outside of a point release
are much more targeted - mostly security and significant bug fixes.
Since there are fewer updates, the security updates stick around for a
while and stand out more.
In Fedora, essentially anything can be updated at any time for any
reason, whenever the packager(s) want. It could be a minor bugfix, a
new upstream release, etc. So the update "churn" tends to be higher.
There could be a security update today to a package (maybe just by
applying a quick patch), and then maybe upstream incorporates the patch
next week (along with other changes) and the Fedora packager updates to
that release. From the Fedora point of view, the second new package is
not addressing any security issue, because the first new package did.
Neither are wrong, they're just different polices.
Right, but does a security update replaced by a non security update will
hide the first security update on RHEL like happens on Fedora?
Because if the problem is how DNF process --security and not how Fedora
and RHEL push security updates metadata, The Red Hat documenting how to
use dnf-automatic to only install security updates is probably not at
all secure. Just wondering where is the problem, metadata or implementation.
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
