On 18 December 2015 at 09:34, Дмитрий Тесёлкин teselkin.d@gmail.com wrote:

Hi all,

I'm trying to clarify the security updates policy for older CentOS-7 releases.

There is a number of servers I'm supporting that are running CentOS-7 1503. When 1511 was released several days ago I've tried to upgrade several of those, but failed. I've got some strange errors with e1000 virtual NIC being restarted frequently with 'tx unit hang' errors. Anyway, it's not the thing I'd like to discuss here.

What I'd like to know is the answer to the question "will there be any security updates for CentOS-7 1503, and how long"? I was searching on a wiki, but couldn't find anything clear enough. What I've found is the phrase in 1511 announcement letter

This release supersedes all previously released content for CentOS Linux 7, and therefore we highly encourage all users to upgrade their machines. Information on different upgrade strategies and how to handle stale content is included in the Release Notes.

This makes me think that there will be no security updates for 1503 and the only way to get them is to upgrade to 1511, but I'd like to find any proof. Unfortunately, there is nothing about this in Release Notes :(

Keep this in mind ... there is only 7 ... there's no point release to pay attention to.

That date (or point release) is just a point in time milestone and carrying out a yum update will continue you along the EL7 path (and /etc/centos-release will be updated in the process as just another update).

The 'older' CentOS release is not 7.0 or 7.1 ... it is 6 or 5 ... similarly 6.6 doesn't get an 'update' as such with yum update just providing the packages in the 6.7 milestone (+ updates).

If you do have a specific need to stay on a particular point release for some arcane and silly reason Red Hat provides a specific z-stream support subscription their sales team can talk to you about.

On 18/12/15 09:34, Дмитрий Тесёлкин wrote:

This makes me think that there will be no security updates for 1503 and the only way to get them is to upgrade to 1511, but I'd like to find any proof. Unfortunately, there is nothing about this in Release Notes :(

Thats right, there are no point release updates, you will also notice that older deprecated content will be removed from mirror.centos.org in a few weeks time.

The way to work around surprises in large installation is to enable the CR/ repos on a select few testing machines - this will give you access, ahead of main release, to the content for the main release. Any update that is going to take more than a few days to get out, is released via CR/ repos first. Also, finding and reporting bugs during this process helps get rectification in before it becomes the default for the entire user base.

Having said this, what exactly is the issue you are facing ?