Since yum-security doesn't seem to work I've created a very rough version of it on my own. It requires expect and yum-changelog to be installed on a machine. It makes the assumption that the CVE number will be in the changelog data for any package with a security patch applied. I have my own rsync'd copy of the 5.3 repository that it check's against (I have around 2 dozen machines that need updating when security patch's come out) so I don't do any serious abuse to someone else's repo.

################################################################## #!/bin/bash

# Get a complete list of packages requiring updates, remove junk lines #and strip them down to the package.arch name. Loop once for each package. for PKG in `yum check-update | grep -v ^Loaded\ plugins | grep -v ^Loading\ mirror | grep -v * | grep -v ^$ | awk '{print $1}'`; do

# get the changelog delta for this package, XXXxxx is a record separator #that isn't likely to exists allowing awk to process the entire result as #one record and return an unknown number of lines UPDATE=`expect -c "set timeout -1; spawn /usr/bin/yum --changelog update $PKG; expect "Is this ok"; send "N"" | awk -v RS="XXXxxx" -F"Changes in packages about to be updated:" '{print $2}' | awk -v RS="XXXxxx" -F"Dependencies Resolved" '{print $1}'`

# check for the existence of "CVE" in the returned changelog, if it exists #echo it to STDOUT echo ${UPDATE} | grep CVE > /dev/null if [ $? -eq 0 ] then echo "#### Changelog Delta's for $PKG and it's dependancies ####" echo "${UPDATE}" fi done

##################################################################

Comments, suggestions. Am I recreating the wheel? If I run it against an online repo it takes about 15-20 minutes to return and makes entirely to many calls to yum. Using my own repo it only takes about 3 minutes and doesn't cost me any extra bandwidth.

---------------------------------------------

Jacob Bresciani, Systems Administrator Advanced E-commerce Research Systems Inc. 2307-4464 Markham Street Victoria, BC CANADA V8Z 7X8 +1 250 418 5412 (mobile) +1 250 483 3271 (FAX) www.terapeak.com - eBay Marketplace Research www.aers.ca - Advanced E-commerce Analytics

-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Kwan Lowe Sent: Tuesday, April 28, 2009 2:45 PM To: CentOS mailing list Subject: Re: [CentOS] Yum Update issues

On Tue, Apr 28, 2009 at 5:10 PM, Ron Blizzard rb4centos@gmail.com wrote:

Has anyone else run into this issue when running yum update?

I've already run yum clear all, but the problem came back when I ran

yum

update again. Firefox and xulrunner were also being "held up," but I

was

able to update them by running yum update firefox.

As far as I can see there is no yum-complete-transaction command.

yum-complete-transaction is part of yum-utils.

I've seen that error if using third-party repositories or the mirror isn't fully updated _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

________________________________

From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Ron Blizzard Sent: Tuesday, April 28, 2009 4:37 PM To: CentOS mailing list Subject: Re: [CentOS] Yum Update issues On Tue, Apr 28, 2009 at 4:45 PM, Kwan Lowe kwan.lowe@gmail.com wrote:

yum-complete-transaction is part of yum-utils. I've seen that error if using third-party repositories or the mirror isn't fully updated

Thanks for the information. I've downloaded the utility and ran yum-complete-transaction, but it won't clear it out. I guess the problem started when I attempted to install kaffeine on a Gnome Desktop (I've had trouble with vlc, so wanted to try kaffeine. vlc still doesn't work for DVDs (segmentation errors) but mplayer plays DVDs.) Here's what I get if I say no to installing kaffeine: [root@localhost ronb]# /usr/sbin/yum-complete-transaction Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * rpmforge: apt.sw.be * base: mirror.raystedman.net * updates: mirrors.kernel.org * addons: mirrors.cat.pdx.edu * extras: mirrors.xmission.com There are 2 outstanding transactions to complete. Finishing the most recent one The remaining transaction had 5 elements left to run There are unfinished transactions remaining. You might consider running yum-complete-transaction first to finish them. --> Running transaction check ---> Package kdnssd-avahi.i386 0:0.1.3-0.1.20060713svn.fc6 set to be updated ---> Package kdelibs.i386 6:3.5.4-18.el5.centos set to be updated ---> Package kaffeine-devel.i386 0:0.7.1-1.2.el5.rf set to be updated ---> Package avahi-qt3.i386 0:0.6.16-1.el5_2.1 set to be updated ---> Package kaffeine.i386 0:0.7.1-1.2.el5.rf set to be updated --> Finished Dependency Resolution ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: avahi-qt3 i386 0.6.16-1.el5_2.1 updates 17 k kaffeine i386 0.7.1-1.2.el5.rf rpmforge 2.8 M kaffeine-devel i386 0.7.1-1.2.el5.rf rpmforge 778 k kdelibs i386 6:3.5.4-18.el5.centos base 18 M kdnssd-avahi i386 0.1.3-0.1.20060713svn.fc6 base 43 k Transaction Summary ================================================================================ Install 5 Package(s) Update 0 Package(s) Remove 0 Package(s) Total size: 22 M Is this ok [y/N]: n Exiting on user Command Not removing old transaction files If I try installing kaffeine (even though I no longer want to) yum-complete-transaction downloads the files but gives the following errors when it tries to install them: ... Total size: 22 M Is this ok [y/N]: y Downloading Packages: Running rpm_check_debug Running Transaction Test Finished Transaction Test Traceback (most recent call last): File "/usr/sbin/yum-complete-transaction", line 226, in ? util = YumCompleteTransaction() File "/usr/sbin/yum-complete-transaction", line 116, in __init__ self.main() File "/usr/sbin/yum-complete-transaction", line 196, in main if self.doTransaction() == 0: File "/usr/share/yum-cli/cli.py", line 439, in doTransaction raise yum.Errors.YumBaseError, errstring + '\n' + \ yum.Errors.YumBaseError: Transaction Check Error: file /usr/share/mimelnk/application/x-mplayer2.desktop conflicts between attempted installs of kaffeine-0.7.1-1.2.el5.rf.i386 and kdelibs-3.5.4-18.el5.centos.i386 Error Summary ------------- I'm not quite sure what this is telling me. Looks like some kind of conflict between mplayer and kaffeine? Maybe if I removed mplayer and then ran yum-complete-transaction? The file /usr/share/mimelnk/application/x-mplayer2.desktop doesn't exist. -- which really makes this odd. -- RonB -- Using CentOS 5.3

This is caused by a packaging bug. They should not ship the x-mplayer2.desktop file in kdelibs nor in kaffeine, but rather have it in mplayer where it belongs. This should be handled in the %install section for these packages. -- Gary L. Greene, Jr. IT Operations Minerva Networks, Inc. Cell: (650) 704-6633 Phone: (408) 240-1239

On Tue, Apr 28, 2009 at 7:49 PM, Ron Blizzard rb4centos@gmail.com wrote:

Thanks for the information. Is there a way to clear out the transaction information, so yum is no longer looking for kaffeine and the kde library files at all?

I'll keep trying to Google for a solution.

Again, thanks.

Okay. I got rid of the kaffeine stuff. Found the transaction files in yum and deleted them. I then ran yum-complete-transaction without errors. So that part of it is fixed.

I then ran "yum clean all" but am still having dependency issues when I try to update.

[root@localhost ronb]# yum update Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * rpmforge: apt.sw.be * base: mirror.its.uidaho.edu * updates: www.gtlib.gatech.edu * addons: mirrors.tummy.com * extras: mirrors.tummy.com Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package SDL_gfx.i386 0:2.0.19-1.el5.rf set to be updated ---> Package perl-SDL.i386 0:2.1.3-2.el5.rf set to be updated --> Processing Dependency: perl(Pod::ToDemo) for package: perl-SDL ---> Package mjpegtools.i386 0:1.9.0-0.6.rc2.el5.rf set to be updated --> Finished Dependency Resolution perl-SDL-2.1.3-2.el5.rf.i386 from rpmforge has depsolving problems --> Missing Dependency: perl(Pod::ToDemo) is needed by package perl-SDL-2.1.3-2.el5.rf.i386 (rpmforge) Error: Missing Dependency: perl(Pod::ToDemo) is needed by package perl-SDL-2.1.3-2.el5.rf.i386 (rpmforge)

I'm guessing I need to find the file that the function(?) that perl(Pod::ToDemo) is found.

rpm.pbone has a file called Perl-Pod-ToDemo, but it won't install, saying it needs Perl5 files -- so I tried reinstalling Perl, but it didn't help.

I'll keep Googling.