devel March 2021

devel@lists.centos.org

30 participants
24 discussions

grub2 sources and build available for Stream
by Josh Boyer 03 Mar '21

03 Mar '21

Yesterday Red Hat released an updated grub2 errata to resolve a CVE. You can find more details about this here: https://access.redhat.com/security/vulnerabilities/RHSB-2021-003 While we have no CVE SLAs for CentOS, I thought it would be worthwhile to point to this given that grub and boothole have been hot topics recently. The sources for this fix are available in git.centos.org for CentOS Stream 8, and a new build has been completed. https://git.centos.org/rpms/grub2/commits/c8s https://koji.mbox.centos.org/koji/buildinfo?buildID=16717 For those of you that also use RHEL, the CentOS Stream changes will land in a future RHEL minor release. Testing and feedback in any case is always welcome. Thanks to the CentOS team for getting this turned around very quickly. josh

1 0

Announcing ROSI - RHEL for Open Source Infrastructure
by Mike McGrath 03 Mar '21

03 Mar '21

Hi all, as I did last month I thought I'd keep the list up to date with today's free RHEL announcement: https://www.redhat.com/en/blog/extending-no-cost-red-hat-enterprise-linux-o… This one is targeted at Open Source projects and organizations. I know some of you, in particular, are interested in academic or non-profit uses. Today's announcement is *not* the one you're looking for so stay tuned, we're still evaluating some of the feedback and more announcements are planned. -- Mike McGrath Linux Engineering - Chicago Red Hat mmcgrath(a)redhat.com T: (312)-660-3547

12 21

Re: [CentOS-devel] re CVE errata in CentOS Stream
by redbaronbrowser 02 Mar '21

02 Mar '21

On Friday, February 19, 2021 5:47 PM, Josh Boyer <jwboyer(a)redhat.com> wrote: > On Fri, Feb 19, 2021 at 5:47 PM redbaronbrowser > redbaronbrowser(a)protonmail.com wrote: > > > I'm not asking for anything ahead of RHEL customers getting it. All I am asking for is pre-approval from management to get access as an Upstream once a problem with RHEL is confirmed. > > If you mean "get access to the fixed code" or "get access to a fixed > build", in a situation like the post-Boot Hole scenario there is no > pre-approval necessary. We will do our best to resolve the issue in > Stream as quickly as possible. You keep coming back to the Fix for the Broken-Fix. I believe you when you say Red Hat has always been working as quickly as possible to Fix any Broken-Fixes. However, once they have the fix the lifecycle of the bug is over. Stream isn't interesting from the perspective of completed bug lifecycles. The interesting aspect to closing the openness gap is the mid-lifecycle of the bug. I am trying to focus on how quickly will Stream users be able to contribute to the fixing of a Broken-Fix. I am sorry if I am parsing too much into Mike's response, but it read to me like it is possible for the code to a Broken-Fix to, by policy, be withheld to only the "entitled" RHEL subscribers to access. I'm asking to what degree Red Hat expects to be able to take advantage us while an active Bugzilla entry exist because a CVE "fix" had unintended side-effects. Can we get quick transparency into accessing broken packages and code even if that broken build is a CVE "fix" related? Or is the policy that we will sit on the sidelines for Red Hat by itself to fix broken security patches much like CentOS has always operated before Stream?

9 32

Meeting minutes of the Storage SIG Monthly, March Edition
by Niels de Vos 02 Mar '21

02 Mar '21

Agenda: https://hackmd.io/Epc35JIESaeotoGzwu5R5w?both#2021-03-02 Minutes: https://www.centos.org/minutes/2021/March/centos-meeting2.2021-03-02-10.00.… Minutes (text): https://www.centos.org/minutes/2021/March/centos-meeting2.2021-03-02-10.00.… Log: https://www.centos.org/minutes/2021/March/centos-meeting2.2021-03-02-10.00.… =========================================================== #centos-meeting2: CentOS Storage SIG monthly, March Edition =========================================================== Meeting started by ndevos at 10:00:58 UTC. The full logs are available at https://www.centos.org/minutes/2021/March/centos-meeting2.2021-03-02-10.00.… . Meeting summary --------------- * Roll Call (ndevos, 10:01:14) * Agenda (ndevos, 10:03:24) * LINK: https://hackmd.io/Epc35JIESaeotoGzwu5R5w?both#2021-03-02 (ndevos, 10:03:29) * centos-release-gluster packages (ndevos, 10:04:34) * Open Floor (ndevos, 10:11:27) * ceph packages update (fmount, 10:13:12) * Any Other Bussiness (ndevos, 10:27:07) Meeting ended at 10:32:11 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * ndevos (58) * fmount (45) * centbot (3) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel March 2021