Red Hat Bugzilla – Bug 1292680
Last modified: 2016-11-03 19:45:09 EDT
<jbrooks> walters, I'm having trouble getting lorax to use the newer anaconda pkg. I tried incrementing the version from -5 to -6, I've tried various other things, but it wants to stick w/ the version of anaconda in the main repo
<jbrooks> I don't know where the breakage is
... snip 20 minutes of debugging ...
Then I notice it's using COPR's default of an https:// baseurl...
<walters> wait this is triggering a memory for me
<walters> and before that commit they were silently ignored
<walters> oh yes
<walters> that commit didn't make it to rhel7-branch
<walters> love when i fix a problem and then a year and a half later i debug it again
<walters> because there were layers and layers of branches and manual integration
<walters> so anyways for now i guess allow anyone with the capability to MITM traffic on the internet to run arbitrary code by just changing it to http://
<walters> (or mirror the repos securely, then use http://, or backport the lorax patch)
<walters> you know what's actually astounding is how many people do yum repos with http://
<walters> i've been tempted to change ostree to explicitly barf if you do this without gpg enabled either
Verified in lorax-19.6.74-1.el7, patch is backported.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.