On 20/06/17 21:14, Simon Matter wrote: >> CentOS 5 is End Of Life. You can still get support from Redhat for RHEL5 >> but it's a EUS subscription (i.e. more money). They do not publish the >> SRPMs for EOL operating systems. > > I know, but I'm quite sure someone can post the patches here and we can > consume them. It's all GPL or did I miss something? I am not a lawyer, and the following is not legal advice. The GPL only requires RH to distribute the complete source to legal entities (individuals and companies) that they are distributing the RHEL binaries to, i.e. their customers - not everybody. RH are already doing more than they have to by providing the SRPMS for the base distribution to everybody, via anonymous FTP. The GPL would probably allow RH customers to redistribute the sources and binaries they receive, but this might immediately terminate their support contract with RH (see https://lwn.net/Articles/721151/). If you still have production systems on CentOS Linux 5, my advice would be to migrate to a supported release or to buy paid support for EL5 from Red Hat, as Trevor suggested (I think migration is the best way, since not even RH can afford to support obsolete releases forever). Relying on RH customers to publish security patches in a timely manner doesn't come to me as wise, especially if, by doing so, said customers would lose access to all future updates from RH. Best regards, Laurențiu