Enable Rocky Linux security repository#2168
Conversation
Rocky Linux has introduced an optional, opt-in Security Repository to ship urgent security fixes ahead of upstream Enterprise Linux when serious vulnerabilities (like CopyFail and Dirty Frag) become publicly exploitable before coordinated fixes arrive. Disabled by default to preserve Rocky's traditional upstream-aligned stability, the repository provides only temporary "bridge" patches that are explicitly versioned to be automatically superseded once upstream releases their own fixes—meaning they carry no errata records and don't appear in `dnf update --security`. The project acknowledges the trade-off: if upstream ultimately declines to fix an issue, the patched package will eventually be replaced by the next upstream release, leaving administrators with options like version-locking rather than an indefinitely maintained fork. Read the official announcement https://rockylinux.org/news/2026-05-14-introducing-security-repository.
Enabling the security repository involves more than one task. Therefore, let's wrap all of them into a role.
|
I think it makes sense to close this PR and usegalaxy-eu/vgcn-infrastructure-playbook#89 in favor of a common role. |
This reverts commit 08becd0.
This reverts commit d6f739f.
Use the new role `usegalaxy_eu.rocky_security_repository` to enable the repository. > Rocky Linux has introduced an optional, opt-in Security Repository to ship urgent security fixes ahead of upstream Enterprise Linux when serious vulnerabilities (like CopyFail and Dirty Frag) become publicly exploitable before coordinated fixes arrive. Disabled by default to preserve Rocky's traditional upstream-aligned stability, the repository provides only temporary "bridge" patches that are explicitly versioned to be automatically superseded once upstream releases their own fixes—meaning they carry no errata records and don't appear in `dnf update --security`. The project acknowledges the trade-off: if upstream ultimately declines to fix an issue, the patched package will eventually be replaced by the next upstream release, leaving administrators with options like version-locking rather than an indefinitely maintained fork.
| collections: | ||
| - name: community.general | ||
| version: 8.0.2 | ||
| version: 8.2.0 |
There was a problem hiding this comment.
This will not break anything I hope
…_security_repository` role
|
@mira-miracoli A point that should be clear is that the role I think that's fine, because |
That sounds to me like a request to move it to |
Move DNF Automatic role |
- One play is dedicated to SSH keys (could be extended to the SSH hardening role, and/or signing the SSH host keys). - The other is dedicated to managing repositories and packages (used only for the Rocky Linux Security Repository, but could be extended to DNF-automatic, EPEL repo, etc).
10d3d4d to
7174561
Compare
3 participants
GLM-5.2 summary (that looks good enough to me):
Read the official announcement https://rockylinux.org/news/2026-05-14-introducing-security-repository. Closes https://github.com/usegalaxy-eu/issues/issues/988.