Re: centralized metadata for security

Muayyad AlSadi wrote:
> I have a silly suggestion
> it's to allow both baseurl and mirrorlist to be used together
> and in this case yum should download repomd.xml from the baseurl
> (which is a very small file) and use the mirrorlist for other files
> 
> this way we avoid having messages like this
> 
> Not using downloaded repomd.xml because it is older than what we have:
> (01:43:55 AM) alsadi:   Current   : Wed Nov  5 10:31:08 2008
> (01:43:55 AM) alsadi:   Downloaded: Tue Nov  4 11:12:35 2008
I think the messages are useful; would be nicer to note:
fedora-updates-testing mirror au.mirrors.org has stale metadata checking 
next mirror...

> what do you think ?
These messages are showing that the mirror downloaded from does not have 
the most current repomd. You might infer that it also does not have the 
most current repodata nor packages. In that case it would be better for 
yum to move along the mirrorlist trying to check if there is a more or 
same timestamped repomd.

If yum instead did what you suggest, it may well be unable to find 
packages that the Current metadata suggest, because it is trying the 
stale mirror it downloaded the old metadata indicator from.

Or perhaps my logic is absurd..

DaveT.