Running yum update -y can be dangerous

[igorgrin]

It looks like in version 5.7 "yum update -y" got introduced.

chef-cookbook/providers/erlang_yum_repository_on_bintray.rb

Line 27 in c5792a4

command 'yum update -y'

That line updates every package on the server. That can be dangerous, a single cookbook should not manage the whole system. For example, I got mongodb upgraded to version 4 because I ran rabbitmq recipe after mongodb recipe.

[michaelklishin]

@igorgrin what alternatives are there for resources that introduce new yum repos? Note that the command's action is :nothing by default so you cannot accidentally upgrade anything.

[michaelklishin]

So the only way to update a single repo is this hack which should work well in our case.

[michaelklishin]

@igorgrin please give the tip of v5.x a try?

[igorgrin]

That does look like a hack... If you add a new repo file to /etc/yum.repos.d/ and then run "yum install yourpackage", it should pull the package from that newly added repo, no? Why do we need to run "yum update" at all?

[igorgrin]

For action: nothing, I understand that this is just a service template, but then you call it on line 57, right?

chef-cookbook/providers/erlang_yum_repository_on_bintray.rb

Line 57 in c5792a4

notifies :run, 'execute[yum update]', :immediately

[michaelklishin]

My point was that you must opt in to use therabbitmq::erlang_yum_repository_on_bintray` provider.

The yum_repository resource uses the same hack for metadata retrieval. So I concluded it's the best we can do with yum at the moment.

We run yum update because without while the yum_repository docs claim that it automatically performs an update, I found it wasn't sufficient in my tests of our Bintray repo provider. However, we now have much better test coverage so if they still pass without the update exec, I have no problem with that.

We now only update a single repo now and Yum should support version pinning (the lack pf which is the real problem with such accidental updates).

[michaelklishin]

I removed the yum update and all tests seem to be still passing 👍