[CentOS-devel] CentOS Stream 9 security patches: Where is polkit?

Wed Feb 2 06:37:14 UTC 2022
Adrian Reber <adrian at lisas.de>

On Tue, Feb 01, 2022 at 05:50:29PM -0800, Gordon Messmer wrote:
> On 2/1/22 15:12, Josh Boyer wrote:
> > It's available in the production compose location:
> > 
> > https://odcs.stream.centos.org/production/CentOS-Stream-9-20220201.0/compose/BaseOS/x86_64/os/Packages/
> > 
> > Those get pushed to mirrors on a regular basis.  I suspect a push is
> > in the works.
> 
> 
> A few things don't look right to me...
> 
> I'm not sure if this one is a real problem, but
> https://download.fedoraproject.org/pub/ redirects me to mirror locations
> that don't exist (e.g. https://uscamirror.lonyai.com/centos-stream/pub). 
> Why would the "/pub/" path redirect to a centos-stream location (let alone
> one that doesn't exist?)

The redirects created by download.fedoraproject.org are, in theory, only
for Fedora. The following does work:

$ curl -i https://download.fedoraproject.org/9-stream/
[...]
location: https://mirror1.hs-esslingen.de/pub/Mirrors/centos-stream/9-stream/

But this was never tested or planned. This is just by chance that it
works. What you currently see is just a redirect configured with wrong
assumptions.

		Adrian