Beta Branch add Rocky Linux security repo hint to cmsec CVE checks in 140.00beta01

add Rocky Linux security repo hint to cmsec CVE checks in 140.00beta01

Following Rocky Linux's announcement of an emergency `security` DNF
repository on 2026-05-14, extend each cmsec check script's "Suggested
next actions" output with a Rocky-side hint paralleling the existing
AlmaLinux testing-repo block.

---

Changes:
- New per-CVE constant ROCKY_SECURITY_REPO_HAS_FIX adjacent to
BASELINE_VERIFIED_DATE in each of the 5 check scripts; set "true" only
for CVE-2026-43500 (RxRPC / kernel-modules-partner — verified on a
Rocky 9.7 host that the security repo ships kernel-modules-partner
5.14.0-611.55.1.el9_7.0.1), "false" for the other 4 CVEs since RHEL
upstream patches reach Rocky baseos directly.
- New elif branch parallel to the existing AlmaLinux if, gated on
os_id="rocky" AND ROCKY_SECURITY_REPO_HAS_FIX="true" AND defensive
file-presence check for /etc/yum.repos.d/rocky-security.repo (the
exact filename ships in rocky-repos package).
- AlmaLinux and Rocky branches are mutually exclusive (one host = one
distro), so they share the same item-number slot in the suggested
actions sequence (item "6." in 31431/43284/46300/46333; item "3."
inside CVE-2026-43500's vulnerable case arm).
- Updated stale comment ("Rocky Linux does not ship an equivalent
end-user testing repo") to describe both distros' repo models.
- No JSON contract, no dispatcher, no osdetect.sh, no cache-state-key,
no Pushover changes. cmsec.sh sets QUIET=1 under --dmotd so new say()
lines emit zero bytes on the login banner hot path.

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01