Stable Branch add cmsec almalinux-testing repo hint when production lags vendor baseline in 132.00stable

add cmsec almalinux-testing repo hint when production lags vendor baseline in 132.00stable

When AlmaLinux publishes a kernel security advisory, the patched kernel
lands in the almalinux-testing repo first and only promotes to production
BaseOS/AppStream after community validation. During that window
'dnf --refresh upgrade' on a production-only host reports 'Nothing to do'
even though cmsec correctly flags the running kernel as VULNERABLE — a
confusing UX gap users were hitting on AlmaLinux 10.1 with the Dirty Frag
fix kernel-6.12.0-124.55.3.el10_1 still in testing as of 2026-05-09.

The new long-form output block fires only when:
- FINAL_STATUS = vulnerable
- os_id = almalinux OR almalinux-kitten

Rocky Linux is intentionally excluded — it does not ship an equivalent
end-user testing repo, so the hint would be misleading on Rocky hosts.

---

Changes:
- tools/cmm-security/checks/check-cve-2026-31431.sh: new item 6 in
Suggested next actions, conditional on vulnerable + AlmaLinux/Kitten.
- tools/cmm-security/checks/check-cve-2026-43284.sh: same.
- tools/cmm-security/checks/check-cve-2026-43500.sh: same, but as item 3
in the slim numbered actions block.

Branch parity with 141.00beta01 (commit b74b644a) and 140.00beta01;
tools/cmm-security/ remains byte-identical across all three branches.

Continue reading...

132.00stable branch

• Branch: https://github.com/centminmod/centminmod/tree/132.00stable
• Commit History: https://github.com/centminmod/centminmod/commits/132.00stable