Using yum --installroot does not seem to reliably respect Vault-only yum repos configuration

[novosirj]

Hi there,

We use Warewulf and create chroots that are ultimately PXE booted to compute nodes. Recently, we've been attempting to pin the YUM config in the images to specific CentOS point releases. Our systems are isolated from the internet, and there are driver compatibility questions so we at least need to manage the upgrades to different point releases on our own timetable.

That said, we've suddenly began to have trouble reliably being working from the 7.5 area in the vault.centos.org. We have our CentOS-Base.repo configured thusly:

Code: Select all

[base]
name=CentOS-7.5 - Base
baseurl=http://vault.centos.org/centos/7.5.1804/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

[updates]
name=CentOS-7.5 - Updates
baseurl=http://vault.centos.org/centos/7.5.1804/updates/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

[extras]
name=CentOS-7.5 - Extras
baseurl=http://vault.centos.org/centos/7.5.1804/extras/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

[centosplus]
name=CentOS-7.5 - Plus
baseurl=http://vault.centos.org/centos/7.5.1804/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

...but when I try "yum --installroot=$CHROOT check-update", I still get an upgrade to 7.6, even though theoretically there are no 7.6 packages visible. I have done "yum clean all", and I've tried with --disablerepo=* and --enablerepo=base to make sure there are no other repos being considered. The stranger thing is that this appears to work properly with no config change at all, but only once in a blue moon.

Can someone help me troubleshoot? I was already pretty sure that --installroot used the installroot PATH for /etc/yum.repos.d and confirmed this with strace since there doesn't appear to be any significant documentation on how this works.

Thanks in advance.

PS: no lectures please on holding to point releases, please. It's occasionally necessary due to factors outside of our control, and we move as soon as is practical.

[TrevorH]

when I try "yum --installroot=$CHROOT check-update", I still get an upgrade to 7.6, even though theoretically there are no 7.6 packages visible

Then you have some other repo enabled that contains those packages because vault does not. What's the output from yum repolist with the same config?

[novosirj]

This has been intermittent and it has stopped doing it again. I hope it never happens again and I look foolish, but if not, I'll follow up.