1

GNOME Software defers updates which are not "important" for a week. It helps avoid overwhelming users on Fedora particularly.

Fedora marks updates with security fixes specially. (Debian and Ubuntu also handle it, by putting security updates in a separate repo).

But what about internet-facing software from third-party repos? Personally I'm thinking of the popular repos google-chrome and rpmfusion (for media software).

Are Google bothering to set these fine details across all the linux distributions they support? Are the rpmfusion packages I look at with changelogs like Update to 3.0.0 - snapshot 20160614, really reviewing the upstream changes for security fixes and marking the corresponding updates?

if (has_important_updates (apps) ||
    no_updates_for_a_week (monitor)) {
    notify_offline_update_available (monitor);
}
0

It seems as if this suspicion is correct:

dnf -q updateinfo list installed sec shows only Fedora packages. This is despite having installed packages from both google-chrome and rpmfusion repos. dnf updateinfo info -v installed google-chrome-stable is simply blank, whereas the same command for package kernel includes Type: security, and a list of fixed bugs including CVEs (globally registered security bugs).

I'm confident there should be security updates here. Web browser releases always include new security updates, and the current version of Google Chrome is no exception.

I'd be surprised to find RPMFusion is doing any better than Google.

Looking at the source code, GNOME Software looks for security updates and also "important" updates. Google Chrome isn't being marked as a security update. The libhif plugin (for packagekit on Fedora) doesn't appear to mark any updates as "Important" either.

  • Third party repos should create an updateinfo.xml which contains the security metadata. – mattdm Sep 13 '16 at 14:31
  • RIght. I've hacked the question a bit, it might read slightly more fairly. – sourcejedi Sep 13 '16 at 15:54
  • I know people at Red Hat who are in communication with Google about their Chrome packaging, and I will bring this up with them. – mattdm Sep 13 '16 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.