<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Oct 6, 2020, 6:14 PM Antal Nemeš <<a href="mailto:Antal.Nemes@hycu.com">Antal.Nemes@hycu.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
<br>
> -----Original Message-----<br>
> From: CentOS-devel <<a href="mailto:centos-devel-bounces@centos.org" target="_blank" rel="noreferrer">centos-devel-bounces@centos.org</a>> On Behalf Of Josh<br>
> Boyer<br>
> Sent: Tuesday, 6 October 2020 14:20<br>
> To: The CentOS developers mailing list. <<a href="mailto:centos-devel@centos.org" target="_blank" rel="noreferrer">centos-devel@centos.org</a>><br>
> Subject: Re: [CentOS-devel] Module version differences between RHEL8 and<br>
> Centos8?<br>
> <br>
> CAUTION: Origin is external! The content might not be safe!<br>
> <br>
> <br>
> On Mon, Oct 5, 2020 at 7:10 PM Antal Nemeš <<a href="mailto:Antal.Nemes@hycu.com" target="_blank" rel="noreferrer">Antal.Nemes@hycu.com</a>><br>
> wrote:<br>
> ><br>
> > > -----Original Message-----<br>
> > > From: CentOS-devel <<a href="mailto:centos-devel-bounces@centos.org" target="_blank" rel="noreferrer">centos-devel-bounces@centos.org</a>> On Behalf Of<br>
> > > Johnny Hughes<br>
> > > Sent: Monday, 5 October 2020 16:53<br>
> > > To: <a href="mailto:centos-devel@centos.org" target="_blank" rel="noreferrer">centos-devel@centos.org</a><br>
> > > Subject: Re: [CentOS-devel] Module version differences between RHEL8<br>
> > > and Centos8?<br>
> > > ><br>
> > ><br>
> > > On 10/4/20 4:54 PM, Antal Nemeš wrote:<br>
> > > > Is there any way to correlate modular package versions in RHEL8.x<br>
> > > > with<br>
> > > ones from Centos8.x in any way, no matter how difficult?<br>
> > > ><br>
> > > > For example, looking at package list for<br>
> > > <a href="https://access.redhat.com/errata/RHSA-2020:3714" rel="noreferrer noreferrer" target="_blank">https://access.redhat.com/errata/RHSA-2020:3714</a>:<br>
> > > > - RedHat lists<br>
> > > > httpd-2.4.37-21.module+el8.2.0+5008+cca404a3.x86_64.rpm<br>
> > > > - in CentOS this (probably?) matches<br>
> > > > httpd-0:2.4.37-21.module_el8.2.0+494+1df74eae.x86_64<br>
> > > ><br>
> > > > AFAIK, the non-modular packages shared the same NEVRA between<br>
> RHEL<br>
> > > and Centos (not sure if there were exceptions, though).<br>
> > > ><br>
> > ><br>
> > > Modules are built by a new component called MBS (Module Build<br>
> System) ..<br>
> > > it works in conjunction with KOJI to do bulids.<br>
> > ><br>
> > > Because of MBS, exact module names are not possible between RHEL<br>
> and<br>
> > > CentOS. This is because 2 things in MBS are generated at build time.<br>
> > > One is an index number .. one is a commit hash from git.<br>
> > ><br>
> > > Since <a href="http://git.centos.org" rel="noreferrer noreferrer" target="_blank">git.centos.org</a> is a closed system and it's hashes will be<br>
> > > different than the internal RHEL git repo .. the hashes will never match for<br>
> commits.<br>
> > ><br>
> > > Also, since the CentOS MBS is a sperate system frmo the RHEL Build<br>
> System ..<br>
> > > the index number for build will also never be the same.<br>
> > ><br>
> > > Therefore, modules will never patch with exact names.<br>
> > ><br>
> ><br>
> > Thanks, that explains a lot<br>
> ><br>
> > Doesn't the import of sources into <a href="http://git.centos.org" rel="noreferrer noreferrer" target="_blank">git.centos.org</a> represent state from<br>
> internal RHEL repos that produced released RHEL packages?<br>
> <br>
> It represents the SRPMs that are in the released RHEL packages.<br>
> <br>
> > Does this import contain any kind of hash reference or any kind of identifier<br>
> from RHEL repo, such that it could be used to link RHEL released modules<br>
> with Centos?<br>
> <br>
> It does not, because the source is pushed from SRPMs, not the internal RHEL<br>
> git repositories.<br>
<br>
Makes sense. But the names of src.rpm published by RHEL do contain index and commit hash, don't they?<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">They contain part of one, yes. The SRPM is exploded though, and the Release version does not contain the hash as it calculated by MBS at build time, as Johnny said. It's part of dist. The import records the full NVR as a tag, but that has no bearing on the CentOS git hash or build system.</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
E.g. from the link I referenced earlier at <a href="https://access.redhat.com/errata/RHSA-2020:3714" rel="noreferrer noreferrer" target="_blank">https://access.redhat.com/errata/RHSA-2020:3714</a> , src.rpm is httpd-2.4.37-21.module+el8.2.0+5008+cca404a3.src.rpm<br>
Are these original src.rpm names lost during the import process?<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">No, but it doesn't matter as explained above.</div><div dir="auto"><br></div><div dir="auto">If you would like to ensure RHEL metadata is useful for the systems you maintain, I would suggest using RHEL. I realize that is not always feasible or desirable for some, but mapping that metadata to binaries built by another project is fairly outside the scope of what it is intended to cover. It would be false to assume the same analysis and metadata applied to binaries that the product teams don't have control over or even look at simply because the NVR matched. Build order, build systems, etc all matter. We make a point to be honest to our customers and to our community projects and only intend errata metadata to cover RHEL itself.</div><div dir="auto"><br></div><div dir="auto">Metadata about CentOS binaries should come from the CentOS project and systems using that OS should rely on that.</div><div dir="auto"><br></div><div dir="auto">josh</div></div>