Stable Branch make cmsec dnf updateinfo and kernel-update checks security-repo awar…

make cmsec dnf updateinfo and kernel-update checks security-repo aware on Rocky in 132.00stable

The CVE-updateinfo and available-kernel-update dnf queries used only the
default-enabled repos, so on Rocky they never saw the opt-in `security` repo
(enabled=0 by default) where the kernel re-spins live. A vulnerable or
behind-on-the-respin Rocky host therefore saw "no updates available" even when
the security repo carried a newer fix.

Changes (four kernel-core checks; 43500 has no dnf-query sections):
- Compute dnf_security_enable=--enablerepo=security only when os_id=rocky AND
/etc/yum.repos.d/rocky-security.repo exists; empty everywhere else.
- Thread it into `dnf updateinfo list --cve` and `dnf --refresh check-update
kernel*` so both surface security-repo content without permanently enabling
the repo. Print a one-line note when it is in effect.

---

Continue reading...

132.00stable branch

• Branch: https://github.com/centminmod/centminmod/tree/132.00stable
• Commit History: https://github.com/centminmod/centminmod/commits/132.00stable