Beta Branch fix cmsec indeterminate verdict on Rocky security-repo .0.N kernels i…

fix cmsec indeterminate verdict on Rocky security-repo .0.N kernels in 140.00beta01

Rocky Linux's opt-in `security` repo ships downstream kernel re-spins with an
extra .0.N suffix after the dist tag (e.g. 4.18.0-553.124.1.el8_10.0.2) — a
parallel version lineage whose base can lag the RHEL baseline while still
carrying backported fixes. dist_tag_compatible() refused the comparison so the
checks returned indeterminate; merely loosening the regex would have reported
false-vulnerable for CVEs whose baseline is numerically higher than the re-spin
base (46300/46333).

Changes:
- Add running_kernel_changelog_confirms_fix() to all five checks; in the
cross-lineage refuse-branch, consult the running kernel's own RPM changelog
for the exact CVE marker (grep -iwF) and mark patched when present —
authoritative regardless of version-string lineage. Set directly in the
refuse-branch (not a late override, since upgrade_status makes vulnerable
sticky), avoiding contradictory output.
- 43500 queries kernel-modules-partner on the rxrpc-present path; the EL8
not_affected short-circuit is untouched.
- Emit changelog_confirms_fix in JSON output.
- Enable the Rocky security-repo upgrade hint for the four kernel-core CVEs.

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01