If I am applying yum install -y --security and a package is updated; how is the package "marked" as a security update?

For example, lets say I have a package blah that I maintain, its current version is 1.18.3. If I build a new package as 1.18.4 is it automatically a "security" package? If not, how/where is the documentation to mark the package as "security" update?

  • If you're building your own packages, you could also put all the security updates in a dedicated repository. Commented Apr 10, 2018 at 3:20

1 Answer 1


yum does this via yum-security(8) plugin which is part of yum (no need install it separately) for CentOS 7 (official RHEL docs).

When you produce yum update ... --security yum download repository meta info updates in /var/lib/<arch>/<repo>. Each package in meta info file (organised as xml file) contains type field in <update> tag. If type=security then update is security update.

When you produce yum update --cve <CVE> or yum update --bugzilla <bugzilla_id> then yum analyses tag <references> for tags <reference> of each package in meta info for field type contains bugzilla. If you typed --cve then CVE comparison to title field of <reference> tag. If you typed --bugzilla, then bugzilla_id comparison to id field of <reference> tag.

The update_md.py file from yum package contains described upper functionality:

$ rpm -ql yum|grep update_md

P.S. Debian packages (DEB) contains urgency field in packages changelogs is might be useful for security updates.

  • 1
    As of CentOS 7, --security doesn't work because there are no meta info for security updates on CentOs repo Commented Sep 18, 2018 at 14:35

You must log in to answer this question.