[Yum] yum-plugin-security (yum-security) plugin not detecting outdated packages in CentOS 5

[James Antill]

RT <rt at ragweed.net> writes:

> All -
>
> I have a older, sparsely used CentOS 5.1 box that I wanted to update with
> only security fixes. I read about yum-security and attempted to use it, but
> the packaged distribution yum (with yum-security) didn't appear to pick up
> the recently released CESA-2009:0427 (udev) update.

 CentOS don't currently distribute any of the security metadata. Eg.

# fgrep updateinfo /var/cache/yum/*/repomd.xml
#

...AIUI the two problems are:

1. The updateinfo also contains information on which BZs are fixed, and
RHEL BZs don't match up with CentOS BZs. So they'd have to write code
to change/add the BZs.

2. The updateinfo is distributed by RH as part of a subscription, not
with the srpms. So even if they ignore #1 they can't just copy the
info. from RH, they have to generate it from other data.

...but this is a CentOS question, not a yum one. Feel free to ask
them, they'll know more than I do.

> # rpm -q yum yum-plugin-security yum-metadata-parser python udev
> libvolume_id
> yum-3.2.22-0
> yum-plugin-security-1.1.21-1

 Good luck with those versions :).
 There is a 3.2.22+ version of yum in testing for 5.4, if CentOS puts
that in testing you probably want to use that ... upgrading to the
latest upstream isn't always the best idea though, IMO.

-- 
James Antill -- james at and.org