[CentOS-devel] docker, CVE-2019-13139 and announcements for updates in extras

Hi Johnny,

On Fri, Jun 4, 2021 at 7:12 PM Johnny Hughes <johnny at centos.org> wrote:
>
[... snip...]
> > I've downloaded the archives of centos-announce since January 2019 and
> > grepped for 'docker'. I only see multiple announcements for pcp, which
> > includes a pcp-pmda-docker RPM, and a reference to Dockerhub. Nothing
> > about docker itself.
> >
> > $ zgrep -i docker 20*
> > 2019-October.txt.gz:db0fdf9b3d888e40a29f021c3200ed40b2be8c05ea27b429783572b3b80ab1ed
> >  pcp-pmda-docker-4.3.2-3.el7_7.x86_64.rpm
> > 2019-October.txt.gz:db0fdf9b3d888e40a29f021c3200ed40b2be8c05ea27b429783572b3b80ab1ed
> >  pcp-pmda-docker-4.3.2-3.el7_7.x86_64.rpm
> > [...]
> > 2020-May.txt.gz:b6614b82c38dbe8d4de61b81d5d779de7fd13d58c341805dfdb1faa7be86538b
> >  pcp-pmda-docker-4.3.2-7.el7_8.x86_64.rpm
> > 2021-March.txt.gz:- We are still in discussions on how to push these
> > properly to Dockerhub.
> >
> > I also think clarifying the process would help.
>
> I build things as they get pushed to git.centos.org .. obviously some
> things are more important than others, and extras is less than base ..
> also we are going through a CentOS Linux 8 release cycle.
>
> We do not announce Extras updates .. only actual OS updates .. on CentOS
> announce .. and then only for CentOS 7 Linux.  So, if something resides
> in the os/ or updates/ repositories, and if they get announced here:
>
> https://access.redhat.com/errata/#/
>
> Then I announce it.  Any other repos, no announcements.

Thanks for clearing things up, that makes sense.

>
> I don't have anything to do with Dockerhub .. someone else will have to
> answer that.

That's just part of an email sent to the list; I think somebody was
announcing CentOS stream Docker images. No worries there.

Not sure what's the more advanced way of searching the list archive, I
did a more 'manual' search with wget and zgrep.

Stefan.