#1039 [rpm] Insecure installed RPMs (like Google Chrome) prevent system updates in F38, can't be removed | rhbz#2170878
Closed by blockerbot. Opened by blockerbot.

Bug details: ** https://bugzilla.redhat.com/show_bug.cgi?id=2170878 **
Information from BlockerBugs App:
2170878

Current vote summary

Commented but haven't voted yet: kparal

The votes have been last counted at 2023-03-06 15:10 UTC and the last processed comment was #comment-845075

To learn how to vote, see:
https://pagure.io/fedora-qa/blocker-review
A quick example: BetaBlocker +1 (where the tracker name is one of BetaBlocker/FinalBlocker/BetaFE/FinalFE/0Day/PreviousRelease and the vote is one of +1/0/-1)


FinalBlocker +1
BetaBlocker +1

I'm hesitant to block a security improvement for something out of our control, but... from what we're seeing on Ask Fedora alone, this is going to hit a lot of people — and the current workaround is intermediate level at minimum.

I'm voting for BetaBlocker because I think we should back this out and then only conditionally re-enable it for the final if we can provide a better workaround (and better workaround experience).

And because the Change contingency deadline is given as Beta Freeze.

Yeah, a lot of people are going to see this as the software management mechanisms not working.

FinalBlocker +1

FinalBlocker +1
BetaBlocker +1

FinalBlocker +1

The Rules Lawyer™ in me says "this doesn't happen with the default package set, so it's fine" but for the benefit of the project, we really should not ship like this.

Please note that probably a cleaner approach is to let FESCo vote on it. I haven't proposed it to FESCo yet, I'm waiting for developer opinions first, but if there's interest, I can create a FESCo request.

BetaBlocker +1

With my FESCo hat on: this is REALLY poor optics. Please bring it to FESCo. I don't think we should let Beta out the door like this.

I think I could vote:
BetaBlocker +1
for this as a violation of Basic criterion "The installed system must be able appropriately to install, remove, and update software with the default console tool for the relevant software type..." - it seems reasonable to count this as not being able to "appropriately update software". But I also think it might be a better idea to handle this as a FESCo blocker, as FESCo could then put in place very specific expectations about how they want this addressed, which it seems to merit.

I created a FESCo ticket here:
https://pagure.io/fesco/issue/2960

We can continue voting here to present our opinions, but I think we should wait with the resolution on FESCo.

BetaBlocker +1

I have had the issue and while it can be resolved, it is really annoying.

(Del this)

Marked the BZ at a Beta blocker as a result of FESCo's decision

AGREED AcceptedBetaBlocker
per FESCo decision

The following votes have been closed:

yeah i figured this was still a problem, when i had a problem with it earlier today

Metadata Update from @blockerbot:
- Issue status updated to: Closed (was: Open)

Release F38 is no longer tracked by BlockerBugs, closing this ticket.

Log in to comment on this ticket.

Metadata