On Sun, Oct 6, 2019, at 21:05, Ladar Levison via CentOS-devel wrote:
Can someone explain what's going on with the kernel? The kernel-4.18.0-80.7.1 package is the latest available via the repos, despite kernel-4.18.0-80.11.2 having been compiled 16 days ago. (https://koji.mbox.centos.org/koji/buildinfo?buildID=4562) The koji downloads appear to still be blocked.
The kernel-4.18.0-144 kernel used to be available via the Stream-BaseOS repo, but it no longer appears to be showing up. The package is still available for download, but it doesn't appear via dnf (although it has previously). I suspect the package was removed from the repo metadata, but the rpm file remains. (http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/Packages/kernel-4....)
To make things even more confusing, the kernel-4.18.0-80.7.2 package was compiled a few days ago. And like the newer kernel-4.18.0-80.11.2, appears to have never been pushed to the repos. (https://koji.mbox.centos.org/koji/buildinfo?buildID=4618)
So my question is why is kernel-4.18.0-80.11.2 available? Why was the older kernel-4.18.0-80.7.2 built, and then never released? Is there an issue with these packages in need of fixing, or it simply a bug in the release/repo process?
The following issues were addressed by these newer kernel packages:
RHSA-2019:2411 / CVE-2019-1125 & CVE-2019-13272
RHSA-2019:2703 / CVE-2019-3846 & CVE-2019-3887 & CVE-2019-9500 & CVE-2019-9503 & CVE-2019-11487 & CVE-2019-12817 & CVE-2018-19824
RHSA-2019:2827 / CVE-2019-14835
I haven't looked into the details, but at first glance the issues seem rather important.
L~
CentOS-devel mailing list CentOS-devel@centos.org https://lists.centos.org/mailman/listinfo/centos-devel
We have a large batch of updates that we were hoping to get out together, but we're still bootstrapping dependencies on a few packages.
I can't give an estimate of when this next batch will go out, but if our blockers continue too much longer we'll attempt to split the batch and release what's ready.
--Brian