On 12/9/20 12:55 PM, James Szinger wrote: > On Wed, 9 Dec 2020 13:22:15 -0500 > Matthew Miller <mattdm at mattdm.org> wrote: > >> On Wed, Dec 09, 2020 at 09:58:10AM -0600, Barry Brimer wrote: >>> If the same happened in the previous question but was in a package >>> or set of packages that was being rebased in 8.5 would it work the >>> same way? >> >> Hmmm. I'm not sure I understand you. There won't be a dump of 8.5 >> packages into Stream at some point. They will be updated there as >> ready. > > The scenario I imagine is this: > > start out the same > EL 8.4 foo-1.1.1-1 > stream-8 foo-1.1.1-1 > > update stream for EL 8.5 > > EL 8.4 foo-1.1.1-1 > stream-8 foo-1.2.0-1 > > CVE! > > EL 8.4 foo-1.1.2-1 > stream-8 foo-1.2.1-1 > > Result: foo-1.1.2-1 is in EL but not stream. Sure .. they only time things will match 100% is at point release time. All the packages in 8.4 will have at some point been in stream when rhel 8.4 is released. Packages in between point releases will not necessarily be in stream .. but their equivalent will be. It will have the CVE and/or bugfix .. it will not likely be the exact same envr, but the one that will be in the new point release.