dnf install rocky-release-security
Download the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.
-Verify the package file's SHA-256 digest with sha256sum. The currently expected digests are:
8daf0934c8b5cfce1f5c2dc53ea0118102940bf307c7cc8863ab718696863da6 rocky-release-security-9-2.el9.noarch.rpm
15aebef7257d4ff3c59a3b4e45acf8fae9894a10ddd2c924dfd521033337e96c rocky-release-security-8-2.el8.noarch.rpm
This isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.
-rpm -U --nodeps. The --nodeps option is needed to bypass the dependency check on our rocky-release package. In essense, you're manually confirming to rpm that you're installing on a compatible distro.Install the package with rpm -U --nodeps. The --nodeps option is needed to bypass the dependency check on our rocky-release package. In essense, you're manually confirming to rpm that you're installing on a compatible distro.
The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.
"},{"location":"#responsibilities","title":"Responsibilities","text":"Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.
"},{"location":"#repo-installation","title":"Repo Installation","text":""},{"location":"#on-rocky-linux","title":"On Rocky Linux","text":"dnf install rocky-release-security\nDownload the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.
rocky-release-security-9
rocky-release-security-8
Verify the package file's SHA-256 digest with sha256sum. The currently expected digests are:
8daf0934c8b5cfce1f5c2dc53ea0118102940bf307c7cc8863ab718696863da6 rocky-release-security-9-2.el9.noarch.rpm\n15aebef7257d4ff3c59a3b4e45acf8fae9894a10ddd2c924dfd521033337e96c rocky-release-security-8-2.el8.noarch.rpm\nThis isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.
rpm -U --nodeps. The --nodeps option is needed to bypass the dependency check on our rocky-release package. In essense, you're manually confirming to rpm that you're installing on a compatible distro.The changes are described in more detail in the package changelogs. More packages/changes are planned, including override packages also for EL8.
"},{"location":"#known-effective-vulnerability-mitigations-and-fixes","title":"Known-effective vulnerability mitigations and fixes","text":"glibc-2.34-60.el9_2.security.0.2 (specifically the .0.2 version!) includes mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL.
The inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on.
"},{"location":"#source-code","title":"Source code","text":"Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches r8 and/or r9 corresponding to target EL version.
If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!
We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.
"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"We hang out in our Security Mattermost channel.
"},{"location":"#members","title":"Members","text":"Some of the people particularly active with setting up this SIG so far:
Name Mattermost Name Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"}]} \ No newline at end of file +{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.
"},{"location":"#responsibilities","title":"Responsibilities","text":"Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.
"},{"location":"#repo-installation","title":"Repo Installation","text":""},{"location":"#on-rocky-linux","title":"On Rocky Linux","text":"dnf install rocky-release-security\nDownload the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.
Verify the package file's SHA-256 digest with sha256sum. The currently expected digests are:
8daf0934c8b5cfce1f5c2dc53ea0118102940bf307c7cc8863ab718696863da6 rocky-release-security-9-2.el9.noarch.rpm\n15aebef7257d4ff3c59a3b4e45acf8fae9894a10ddd2c924dfd521033337e96c rocky-release-security-8-2.el8.noarch.rpm\nThis isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.
Install the package with rpm -U --nodeps. The --nodeps option is needed to bypass the dependency check on our rocky-release package. In essense, you're manually confirming to rpm that you're installing on a compatible distro.
The changes are described in more detail in the package changelogs. More packages/changes are planned, including override packages also for EL8.
"},{"location":"#known-effective-vulnerability-mitigations-and-fixes","title":"Known-effective vulnerability mitigations and fixes","text":"glibc-2.34-60.el9_2.security.0.2 (specifically the .0.2 version!) includes mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL.
The inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on.
"},{"location":"#source-code","title":"Source code","text":"Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches r8 and/or r9 corresponding to target EL version.
If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!
We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.
"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"We hang out in our Security Mattermost channel.
"},{"location":"#members","title":"Members","text":"Some of the people particularly active with setting up this SIG so far:
Name Mattermost Name Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"}]} \ No newline at end of file diff --git a/sitemap.xml.gz b/sitemap.xml.gz index 1a103621c33747273be361e8e83b09e4ddee064a..8230e5117c58e4f1e1c3862dd6b1cdc5a8160114 100644 GIT binary patch delta 14 VcmX@lc%G3>zMF$%WBWw5lK>-F1o;2} delta 14 VcmX@lc%G3>zMF&Nd&@+&lK>>D1v~%%