After a ‘dnf update’ today that got me to Rocky 8.10 I reboot and run ‘dnf update’ again and I am told everything is up to date.
I then run ‘dnf updateinfo list’ and I get
> # dnf updateinfo list
> Last metadata expiration check: 0:08:21 ago on Tue 11 Jun 2024 11:05:59 AM EDT.
> RLSA-2022:4941 Important/Sec. subversion-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
> RLBA-2022:7542 bugfix subversion-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
> RLSA-2022:4941 Important/Sec. subversion-libs-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
> RLBA-2022:7542 bugfix subversion-libs-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
> RLSA-2022:4941 Important/Sec. subversion-perl-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
> RLBA-2022:7542 bugfix subversion-perl-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64
Odd, why did that not update with ‘dnf update’. I run
> # dnf list subversion --showduplicates
> Last metadata expiration check: 0:12:17 ago on Tue 11 Jun 2024 11:05:59 AM EDT.
> Installed Packages
> subversion.x86_64 1.10.2-5.module+el8.7.0+1065+42200b2e @AppStream
> Available Packages
> subversion.x86_64 1.10.2-5.module+el8.7.0+1065+42200b2e Local-AppStream
and this new version is not listed. I have a local mirror repo at /space/centos/8.10 and it is definitely there:
> # find /space/centos/8.10/ -name 'subversion-1.14*'
> /space/centos/8.10/AppStream/x86_64/os/Packages/s/subversion-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64.rpm
> /space/centos/8.10/AppStream/x86_64/kickstart/Packages/s/subversion-1.14.1-2.module+el8.7.0+1066+f8abeb19.x86_64.rpm
Why is this new version not found and installed? I assume it some module strangeness and run
> # dnf module list subversion
> Last metadata expiration check: 0:21:08 ago on Tue 11 Jun 2024 11:05:59 AM EDT.
> Rocky 8 - AppStream (local)
> Name Stream Profiles Summary
> subversion 1.10 [d][e] common [d], server Apache Subversion
> subversion 1.14 common [d], server Apache Subversion
>
> Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled
Okay, so it is new module track for subversion. But I am confused.
- does the security info mean my old module track is vulnerable and I need to update the module track? Or am I safe sticking to the 1.10 track?
- if I am not safe, how is one really supposed to stay “safe” now with these module tracks? In the past simply doing ‘dnf update’ periodically (even automated) was supposed to do that. Is that no longer the case?