[CentOS-devel] Is there any way to follow errata for Stream 8?

On 8/19/21 11:21 PM, John R. Dennison wrote:
> On Fri, Aug 20, 2021 at 06:05:49AM +0200, Steven Rosenberg via CentOS-devel wrote:
>> Even emails like I see for for CentOS 7 would be ok.
> 
> Considering that people have had nearly 2 years to get such notices out
> for 8 and it's still not happened I wouldn't hold my breath if I were
> you.
> 

I would provide the information if i could, it is not easy to do because
of modularity.

The thing that builds el8 modules is called MBS .. if you look at MBS
operations, one of the things that gets generated as part of the
filename.  Here is an example:

https://koji.mbox.centos.org/koji/buildinfo?buildID=18783

Part of the file name is dynamic, created by MBS at build time.  For
example, one of the Source RPM filenames generated is:

runc-1.0.0-74.rc95.module_el8.4.0+886+c9a8d9ad.src.rpm

That is not it's filename in RHEL8.  In RHEL 8 .. the filename is:

runc-1.0.0-74.rc95.module+el8.4.0+11822+6cc1e7d7.src.rpm

There is no easy way to figure out the file names that match up between
the two systems.  I took me 15 minutes to figure out that one filename,
this does not scale.

The two dynamic parts are an index number (the 886 in the centos rpm and
11822 in the rhel rpm) and a git commit id (c9a8d9ad and c9a8d9ad).

There does not exist a way to cross reference those items to each other
and they will never be the same as they are being built on two different
closed systems.

I asked for community help to be able to possibly figure out a way to
cross reference these items and I got zero response.  It must then not
be very important to the CentOS Community.

That is for actual CentOS Linux 8 and just modularity differences.  In
Stream 8 there are other differences.  Some number of packages, besides
modules, will be exactly the same between RHEL 8.4 and RHEL 8.5 ..
usually around 80%-90% .. so that leaved 10-20% of packages that are
different between CentOS Stream 8 and RHEL 8 at any point in time.

The bottom line is .. zero modules and about 10-20% of packages do not
match up with the errata at any given time for Stream.

If someone wants audited packages with software assurance .. Red Hat has
thousands of people who do that, who create errata metadata and publish
it .. that is one of the things you are paying for with RHEL :)

To reiterate .. IF I had the information available for CentOS Linux 8, I
would have provided it. Much less of it will be relevant to CentOS
Stream 8 than was relevant to CentOS Linux 8.