Blame SOURCES/BZ-1002491-remove-security-plugin.patch

5b4f08
commit a5c7a3011bb9d2497c980791111389d226445281
5b4f08
Author: Zdenek Pavlas <zpavlas@redhat.com>
5b4f08
Date:   Thu Oct 3 14:15:11 2013 +0200
5b4f08
5b4f08
    remove yum-plugin-security. BZ 1002491
5b4f08
    
5b4f08
    This functionality is now implemented in core (yum updateinfo).
5b4f08
5b4f08
diff --git a/docs/Makefile b/docs/Makefile
5b4f08
index acb8559..481f0f3 100644
5b4f08
--- a/docs/Makefile
5b4f08
+++ b/docs/Makefile
5b4f08
@@ -5,7 +5,7 @@ DOCS = repoquery package-cleanup repo-rss yumdownloader yum-builddep yum-changel
5b4f08
        find-repos-of-install needs-restarting repo-graph repoclosure \
5b4f08
        repomanage repotrack verifytree yum-config-manager
5b4f08
 DOCS5 = yum-changelog.conf yum-versionlock.conf yum-fs-snapshot.conf
5b4f08
-DOCS8 = yum-security yum-complete-transaction yumdb
5b4f08
+DOCS8 = yum-complete-transaction yumdb
5b4f08
 
5b4f08
 all:
5b4f08
 	echo "Nothing to do"
5b4f08
diff --git a/docs/yum-security.8 b/docs/yum-security.8
5b4f08
deleted file mode 100644
5b4f08
index c7d9c8b..0000000
5b4f08
--- a/docs/yum-security.8
5b4f08
+++ /dev/null
5b4f08
@@ -1,190 +0,0 @@
5b4f08
-.\" yum security plugin
5b4f08
-.TH "yum-security" "8" "12 April 2007" "James Antill" ""
5b4f08
-.SH "NAME"
5b4f08
-yum security plugin
5b4f08
-.SH "SYNOPSIS"
5b4f08
-\fByum\fP [options] [command] [package ...]
5b4f08
-.SH "DESCRIPTION"
5b4f08
-.PP 
5b4f08
-This plugin extends \fByum\fP to allow lists and updates to be limited using security relevant criteria.
5b4f08
-.PP 
5b4f08
-Added yum \fIcommand\fPs are:
5b4f08
-.br 
5b4f08
-.I \fR yum update-minimal
5b4f08
-.PP 
5b4f08
-This works like the update command, but if you have the package foo-1
5b4f08
-installed and have foo-2 and foo-3 available with updateinfo.xml then
5b4f08
-update-minimal will update you to foo-3.
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo info
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo list
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo summary
5b4f08
-.PP 
5b4f08
-All of the last three take these \fIsub-command\fPs:
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo * all
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo * available
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo * installed
5b4f08
-.br 
5b4f08
-.I \fR yum updateinfo * updates
5b4f08
-.PP 
5b4f08
-and then:
5b4f08
-.br 
5b4f08
-.I \fR * <advisory> [advisory...]
5b4f08
-.br 
5b4f08
-.I \fR * <package>
5b4f08
-.br 
5b4f08
-.I \fR * bugzillas
5b4f08
-.br 
5b4f08
-.I \fR * cves
5b4f08
-.br 
5b4f08
-.I \fR * enhancement
5b4f08
-.br 
5b4f08
-.I \fR * security
5b4f08
-.br 
5b4f08
-.I \fR * new-packages
5b4f08
-.br 
5b4f08
-.br 
5b4f08
-.PP
5b4f08
-.IP "\fBall\fP"
5b4f08
-Is used to display information about both install and available advisories.
5b4f08
-.PP
5b4f08
-.IP "\fBavailable\fP"
5b4f08
-Is used to display information about just available advisories. This is the
5b4f08
-default.
5b4f08
-.PP
5b4f08
-.IP "\fBinstalled\fP"
5b4f08
-Is used to display information about just install advisories.
5b4f08
-.PP
5b4f08
-.IP "\fBupdates\fP"
5b4f08
-This is mostly the same as "available" but it only shows advisory information
5b4f08
-for packages that can be updated to.
5b4f08
-.PP
5b4f08
-.IP "\fB<advisory> [advisory...]\fP"
5b4f08
-Is used to display information about one or more advisories.
5b4f08
-.PP 
5b4f08
-.IP "\fB<package> [package...]\fP"
5b4f08
-Is used to display information about one or more packages.
5b4f08
-.PP 
5b4f08
-.IP "\fBlist\fP"
5b4f08
-Is used to list all of the relevant errata notice information, from the
5b4f08
-updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and
5b4f08
-new.
5b4f08
-.PP 
5b4f08
-.IP "\fBinfo\fP"
5b4f08
-Is used to show all the errata notice information, from the
5b4f08
-updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and
5b4f08
-new.
5b4f08
-.PP 
5b4f08
-.IP "\fBlist\fP"
5b4f08
-Is used to list all of the relevant errata notice information, from the
5b4f08
-updateinfo.xml data in yum. This includes bugzillas, CVEs, security updates and
5b4f08
-new.
5b4f08
-.IP 
5b4f08
-.IP "\fBbugzillas / bzs\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to the bugzillas.
5b4f08
-.IP 
5b4f08
-.IP "\fBcves\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to the CVEs.
5b4f08
-.IP 
5b4f08
-.IP "\fBsecurity / sec\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to security.
5b4f08
-.IP "\fBbugfix\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to bugfixes.
5b4f08
-.IP "\fBenhancement\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to enhancements.
5b4f08
-.IP "\fBrecommended\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to recommended updates.
5b4f08
-.IP "\fBnew-packages\fP"
5b4f08
-Is the subset of the updateinfo information, pertaining to new packages. These
5b4f08
-are packages which weren't available at the initial release of your
5b4f08
-distribution.
5b4f08
-.IP
5b4f08
-.PP
5b4f08
-.SH "GENERAL OPTIONS"
5b4f08
-There are four options added to yum that are available in the "list updates", "info updates", "check-update" and "update" commands. They are:
5b4f08
-.PP 
5b4f08
-.IP "\fB\-\-advisory\fP"
5b4f08
-This option includes packages corresponding to the advisory ID, Eg. FEDORA-2201-123.
5b4f08
-.IP "\fB\-\-bz\fP"
5b4f08
-This option includes packages that say they fix a Bugzilla ID, Eg. 123.
5b4f08
-.IP "\fB\-\-cve\fP"
5b4f08
-This option includes packages that say they fix a CVE - Common Vulnerabilities and Exposures ID (http://cve.mitre.org/about/), Eg. CVE-2201-0123.
5b4f08
-.IP "\fB\-\-bugfixes\fP"
5b4f08
-This option includes packages that say they fix a bugfix issue.
5b4f08
-.IP "\fB\-\-security\fP"
5b4f08
-This option includes packages that say they fix a security issue.
5b4f08
-.PP
5b4f08
-.PP
5b4f08
-
5b4f08
-.SH "EXAMPLES"
5b4f08
-.PP
5b4f08
-To list all updates that are security relevant, and get a return code on whether there are security updates use:
5b4f08
-.IP
5b4f08
-yum \-\-security check-update
5b4f08
-.PP
5b4f08
-To upgrade packages that have security errata (upgrades to the latest
5b4f08
-available package) use:
5b4f08
-.IP
5b4f08
-yum \-\-security update
5b4f08
-.PP
5b4f08
-To upgrade packages that have security errata (upgrades to the last
5b4f08
-security errata package) use:
5b4f08
-.IP
5b4f08
-yum \-\-security update-minimal
5b4f08
-.PP
5b4f08
-To get a list of all BZs that are fixed for packages you have installed use:
5b4f08
-.IP
5b4f08
-yum updateinfo list bugzillas
5b4f08
-.PP
5b4f08
-To get a list of all security advisories, including the ones you have already
5b4f08
-installed use:
5b4f08
-.IP
5b4f08
-yum updateinfo list all security
5b4f08
-.PP
5b4f08
-To get the information on advisory FEDORA-2707-4567 use:
5b4f08
-.IP
5b4f08
-yum updateinfo info FEDORA-2707-4567
5b4f08
-.PP
5b4f08
-To update packages to the latest version which contain fixes for Bugzillas 123, 456 and 789; and all security updates use:
5b4f08
-.IP
5b4f08
-yum \-\-bz 123 \-\-bz 456 \-\-bz 789 \-\-security update
5b4f08
-.PP
5b4f08
-To update to the packages which just update Bugzillas 123, 456 and 789; and all security updates use:
5b4f08
-.IP
5b4f08
-yum \-\-bz 123 \-\-bz 456 \-\-bz 789 \-\-security update-minimal
5b4f08
-.PP
5b4f08
-To get an info list of the latest packages which contain fixes for Bugzilla 123; CVEs CVE-2207-0123 and CVE-2207-3210; and Fedora advisories FEDORA-2707-4567 and FEDORA-2707-7654 use:
5b4f08
-.IP
5b4f08
-yum \-\-bz 123 \-\-cve CVE-2207-0123 \-\-cve CVE-2207-3210 \-\-advisory FEDORA-2707-4567 \-\-advisory FEDORA-2707-7654 info updates
5b4f08
-.PP
5b4f08
-To get a list of packages which are "new".
5b4f08
-.IP
5b4f08
-yum updateinfo list new
5b4f08
-.PP
5b4f08
-To get a summary of advisories you haven't installed yet use:
5b4f08
-.IP
5b4f08
-yum updateinfo summary
5b4f08
-
5b4f08
-
5b4f08
-.SH "SEE ALSO"
5b4f08
-.nf
5b4f08
-.I yum (8)
5b4f08
-.I yum.conf (5)
5b4f08
-.fi
5b4f08
-
5b4f08
-.SH "AUTHORS"
5b4f08
-.nf
5b4f08
-James Antill <james.antill@redhat.com>.
5b4f08
-.fi
5b4f08
-
5b4f08
-.SH "BUGS"
5b4f08
-The update-minimal command ignores the \-\-obsoletes flag.
5b4f08
-
5b4f08
-The update-minimal command can only directly affect things atm., so if you update pkgA minimally but that requires an update to pkgB then pkgB will be updated to the newest version by the depsolver. Also the above will happen even if you've also minimally updated pkgB, if either the direct (minimal) update for pkgB happens after or if the minimal update for pkgB doesn't satisfy the requirements of pkgA.
5b4f08
-
5b4f08
-The main "problem" is that if the data is not correct the plugin cannot work correctly. For instance "\-\-bz 123" will not fix BZ 123 if a package is updated to fix that BZ without referencing that it does so in the updateinfo.xml.
5b4f08
diff --git a/plugins/security/security.conf b/plugins/security/security.conf
5b4f08
deleted file mode 100644
5b4f08
index 8e4d76c..0000000
5b4f08
--- a/plugins/security/security.conf
5b4f08
+++ /dev/null
5b4f08
@@ -1,2 +0,0 @@
5b4f08
-[main]
5b4f08
-enabled=1
5b4f08
diff --git a/plugins/security/security.py b/plugins/security/security.py
5b4f08
deleted file mode 100755
5b4f08
index a60cf9b..0000000
5b4f08
--- a/plugins/security/security.py
5b4f08
+++ /dev/null
5b4f08
@@ -1,892 +0,0 @@
5b4f08
-#! /usr/bin/python -tt
5b4f08
-# This program is free software; you can redistribute it and/or modify
5b4f08
-# it under the terms of the GNU General Public License as published by
5b4f08
-# the Free Software Foundation; either version 2 of the License, or
5b4f08
-# (at your option) any later version.
5b4f08
-#
5b4f08
-# This program is distributed in the hope that it will be useful,
5b4f08
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
5b4f08
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
5b4f08
-# GNU Library General Public License for more details.
5b4f08
-#
5b4f08
-# You should have received a copy of the GNU General Public License
5b4f08
-# along with this program; if not, write to the Free Software
5b4f08
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
5b4f08
-#
5b4f08
-#
5b4f08
-# Copyright Red Hat Inc. 2007, 2008
5b4f08
-#
5b4f08
-# Author: James Antill <james.antill@redhat.com>
5b4f08
-#
5b4f08
-# Examples:
5b4f08
-#
5b4f08
-#  yum --security info updates
5b4f08
-#  yum --security list updates
5b4f08
-#  yum --security check-update
5b4f08
-#  yum --security update
5b4f08
-#
5b4f08
-# yum --cve CVE-2007-1667      <cmd>
5b4f08
-# yum --bz  235374 --bz 234688 <cmd>
5b4f08
-# yum --advisory FEDORA-2007-420 --advisory FEDORA-2007-346 <cmd>
5b4f08
-#
5b4f08
-# yum list-updateinfo
5b4f08
-# yum list-updateinfo bugzillas / bzs
5b4f08
-# yum list-updateinfo cves
5b4f08
-# yum list-updateinfo security / sec
5b4f08
-# yum list-updateinfo new
5b4f08
-#
5b4f08
-# yum summary-updateinfo
5b4f08
-#
5b4f08
-# yum update-minimal --security
5b4f08
-
5b4f08
-import yum
5b4f08
-import fnmatch
5b4f08
-from yum.plugins import TYPE_INTERACTIVE
5b4f08
-from yum.update_md import UpdateMetadata
5b4f08
-import logging # for commands
5b4f08
-
5b4f08
-from yum.constants import *
5b4f08
-
5b4f08
-import rpmUtils.miscutils
5b4f08
-
5b4f08
-requires_api_version = '2.5'
5b4f08
-plugin_type = (TYPE_INTERACTIVE,)
5b4f08
-__package_name__ = "yum-plugin-security"
5b4f08
-
5b4f08
-# newpackages is weird, in that we'll never display that because we filter to
5b4f08
-# things relevant to installed pkgs...
5b4f08
-__update_info_types__ = ("security", "bugfix", "enhancement",
5b4f08
-                         "recommended", "newpackage")
5b4f08
-
5b4f08
-def _rpm_tup_vercmp(tup1, tup2):
5b4f08
-    """ Compare two "std." tuples, (n, a, e, v, r). """
5b4f08
-    return rpmUtils.miscutils.compareEVR((tup1[2], tup1[3], tup1[4]),
5b4f08
-                                         (tup2[2], tup2[3], tup2[4]))
5b4f08
-
5b4f08
-class CliError(yum.Errors.YumBaseError):
5b4f08
-
5b4f08
-    """
5b4f08
-    Command line interface related Exception.
5b4f08
-    """
5b4f08
-
5b4f08
-    def __init__(self, args=''):
5b4f08
-        yum.Errors.YumBaseError.__init__(self)
5b4f08
-        self.args = args
5b4f08
-
5b4f08
-def ysp_gen_metadata(repos):
5b4f08
-    """ Generate the info. from the updateinfo.xml files. """
5b4f08
-    md_info = UpdateMetadata()
5b4f08
-    for repo in repos:
5b4f08
-        if not repo.enabled:
5b4f08
-            continue
5b4f08
-        
5b4f08
-        try: # attempt to grab the updateinfo.xml.gz from the repodata
5b4f08
-            md_info.add(repo)
5b4f08
-        except yum.Errors.RepoMDError:
5b4f08
-            continue # No metadata found for this repo
5b4f08
-    return md_info
5b4f08
-
5b4f08
-def ysp__safe_refs(refs):
5b4f08
-    """ Sometimes refs == None, if so return the empty list here. 
5b4f08
-        So we don't have to check everywhere. """
5b4f08
-    if refs == None:
5b4f08
-        return []
5b4f08
-    return refs
5b4f08
-
5b4f08
-def _match_sec_cmd(sec_cmds, pkgname, notice):
5b4f08
-    for i in sec_cmds:
5b4f08
-        if fnmatch.fnmatch(pkgname, i):
5b4f08
-            return i
5b4f08
-        if notice['update_id'] == i:
5b4f08
-            return i
5b4f08
-    return None
5b4f08
-
5b4f08
-def _has_id(used_map, refs, ref_type, ref_ids):
5b4f08
-    ''' Check if the given ID is a match. '''
5b4f08
-    for ref in ysp__safe_refs(refs):
5b4f08
-        if ref['type'] != ref_type:
5b4f08
-            continue
5b4f08
-        if ref['id'] not in ref_ids:
5b4f08
-            continue
5b4f08
-        used_map[ref_type][ref['id']] = True
5b4f08
-        return ref
5b4f08
-    return None
5b4f08
-    
5b4f08
-def ysp_should_filter_pkg(opts, pkgname, notice, used_map):
5b4f08
-    """ Do the package filtering for should_show and should_keep. """
5b4f08
-    
5b4f08
-    rcmd = _match_sec_cmd(opts.sec_cmds, pkgname, notice)
5b4f08
-    if rcmd:
5b4f08
-        used_map['cmd'][rcmd] = True
5b4f08
-        return True
5b4f08
-    elif opts.advisory and notice['update_id'] in opts.advisory:
5b4f08
-        used_map['id'][notice['update_id']] = True
5b4f08
-        return True
5b4f08
-    elif (opts.severity and notice['type'] == 'security' and
5b4f08
-          notice['severity'] in opts.severity):
5b4f08
-        used_map['sev'][notice['severity']] = True
5b4f08
-        return True
5b4f08
-    elif opts.cve and _has_id(used_map, notice['references'], "cve", opts.cve):
5b4f08
-        return True
5b4f08
-    elif opts.bz and _has_id(used_map, notice['references'],"bugzilla",opts.bz):
5b4f08
-        return True
5b4f08
-    # FIXME: Add opts for enhancement/etc.? -- __update_info_types__
5b4f08
-    elif (opts.security and notice['type'] == 'security' and
5b4f08
-          (not opts.severity or 'severity' not in notice or
5b4f08
-           not notice['severity'])):
5b4f08
-        return True
5b4f08
-    elif opts.bugfixes and notice['type'] == 'bugfix':
5b4f08
-        return True
5b4f08
-    elif not (opts.advisory or opts.cve or opts.bz or
5b4f08
-              opts.security or opts.bugfixes or opts.sec_cmds or opts.severity):
5b4f08
-        return True # This is only possible from should_show_pkg
5b4f08
-    return False
5b4f08
-
5b4f08
-def ysp_has_info_md(rname, md):
5b4f08
-    if rname in __update_info_types__:
5b4f08
-        if md['type'] == rname:
5b4f08
-            return md
5b4f08
-    for ref in ysp__safe_refs(md['references']):
5b4f08
-        if ref['type'] != rname:
5b4f08
-            continue
5b4f08
-        return md
5b4f08
-
5b4f08
-def ysp_gen_used_map(opts):
5b4f08
-    used_map = {'bugzilla' : {}, 'cve' : {}, 'id' : {}, 'cmd' : {}, 'sev' : {}}
5b4f08
-    for i in opts.sec_cmds:
5b4f08
-        used_map['cmd'][i] = False
5b4f08
-    for i in opts.advisory:
5b4f08
-        used_map['id'][i] = False
5b4f08
-    for i in opts.bz:
5b4f08
-        used_map['bugzilla'][i] = False
5b4f08
-    for i in opts.cve:
5b4f08
-        used_map['cve'][i] = False
5b4f08
-    for i in opts.severity:
5b4f08
-        used_map['sev'][i] = False
5b4f08
-    return used_map
5b4f08
-
5b4f08
-def ysp_chk_used_map(used_map, msg):
5b4f08
-    for i in used_map['cmd']:
5b4f08
-        if not used_map['cmd'][i]:
5b4f08
-            msg('No update information found for \"%s\"' % i)
5b4f08
-    for i in used_map['id']:
5b4f08
-        if not used_map['id'][i]:
5b4f08
-            msg('Advisory \"%s\" not found applicable for this system' % i)
5b4f08
-    for i in used_map['bugzilla']:
5b4f08
-        if not used_map['bugzilla'][i]:
5b4f08
-            msg('BZ \"%s\" not found applicable for this system' % i)
5b4f08
-    for i in used_map['cve']:
5b4f08
-        if not used_map['cve'][i]:
5b4f08
-            msg('CVE \"%s\" not found applicable for this system' % i)
5b4f08
-    for i in used_map['sev']:
5b4f08
-        if not used_map['sev'][i]:
5b4f08
-            msg('Severity \"%s\" not found applicable for this system' % i)
5b4f08
-
5b4f08
-class UpdateinfoCommand:
5b4f08
-    # Old command names...
5b4f08
-    direct_cmds = {'list-updateinfo'    : 'list',
5b4f08
-                   'list-security'      : 'list',
5b4f08
-                   'list-sec'           : 'list',
5b4f08
-                   'info-updateinfo'    : 'info',
5b4f08
-                   'info-security'      : 'info',
5b4f08
-                   'info-sec'           : 'info',
5b4f08
-                   'summary-updateinfo' : 'summary'}
5b4f08
-
5b4f08
-    #  Note that this code (instead of using inheritance and multiple
5b4f08
-    # cmd classes) means that "yum help" only displays the updateinfo command.
5b4f08
-    # Which is what we want, because the other commands are just backwards
5b4f08
-    # compatible gunk we don't want the user using).
5b4f08
-    def getNames(self):
5b4f08
-        return ['updateinfo'] + sorted(self.direct_cmds.keys())
5b4f08
-
5b4f08
-    def getUsage(self):
5b4f08
-        return "[info|list|...] [security|...] [installed|available|all] [pkgs|id]"
5b4f08
-
5b4f08
-    def getSummary(self):
5b4f08
-        return "Acts on repository update information"
5b4f08
-
5b4f08
-    def doCheck(self, base, basecmd, extcmds):
5b4f08
-        pass
5b4f08
-
5b4f08
-    def list_show_pkgs(self, base, md_info, list_type, show_type,
5b4f08
-                       iname2tup, data, msg):
5b4f08
-        n_maxsize = 0
5b4f08
-        r_maxsize = 0
5b4f08
-        t_maxsize = 0
5b4f08
-        for (notice, pkgtup, pkg) in data:
5b4f08
-            n_maxsize = max(len(notice['update_id']), n_maxsize)
5b4f08
-            tn = notice['type']
5b4f08
-            if tn == 'security' and notice['severity']:
5b4f08
-                tn = notice['severity'] + '/Sec.'
5b4f08
-            t_maxsize = max(len(tn),                  t_maxsize)
5b4f08
-            if show_type:
5b4f08
-                for ref in ysp__safe_refs(notice['references']):
5b4f08
-                    if ref['type'] != show_type:
5b4f08
-                        continue
5b4f08
-                    r_maxsize = max(len(str(ref['id'])), r_maxsize)
5b4f08
-
5b4f08
-        for (notice, pkgtup, pkg) in data:
5b4f08
-            mark = ''
5b4f08
-            if list_type == 'all':
5b4f08
-                mark = '  '
5b4f08
-                if _rpm_tup_vercmp(iname2tup[pkgtup[0]], pkgtup) >= 0:
5b4f08
-                    mark = 'i '
5b4f08
-            tn = notice['type']
5b4f08
-            if tn == 'security' and notice['severity']:
5b4f08
-                tn = notice['severity'] + '/Sec.'
5b4f08
-
5b4f08
-            if show_type and ysp_has_info_md(show_type, notice):
5b4f08
-                for ref in ysp__safe_refs(notice['references']):
5b4f08
-                    if ref['type'] != show_type:
5b4f08
-                        continue
5b4f08
-                    msg("%s %-*s %-*s %s" % (mark, r_maxsize, str(ref['id']),
5b4f08
-                                             t_maxsize, tn, pkg))
5b4f08
-            elif hasattr(pkg, 'name'):
5b4f08
-                print base.fmtKeyValFill("%s: " % pkg.name,
5b4f08
-                                         base._enc(pkg.summary))
5b4f08
-            else:
5b4f08
-                msg("%s%-*s %-*s %s" % (mark, n_maxsize, notice['update_id'],
5b4f08
-                                        t_maxsize, tn, pkg))
5b4f08
-
5b4f08
-    def info_show_pkgs(self, base, md_info, list_type, show_type,
5b4f08
-                       iname2tup, data, msg):
5b4f08
-        show_pkg_info_done = {}
5b4f08
-        for (notice, pkgtup, pkg) in data:
5b4f08
-            if notice['update_id'] in show_pkg_info_done:
5b4f08
-                continue
5b4f08
-            show_pkg_info_done[notice['update_id']] = notice
5b4f08
-
5b4f08
-            if hasattr(notice, 'text'):
5b4f08
-                debug_log_lvl = yum.logginglevels.DEBUG_3
5b4f08
-                vlog = logging.getLogger("yum.verbose.main")
5b4f08
-                if vlog.isEnabledFor(debug_log_lvl):
5b4f08
-                    obj = notice.text(skip_data=[])
5b4f08
-                else:
5b4f08
-                    obj = notice.text()
5b4f08
-            else:
5b4f08
-                # Python-2.4.* doesn't understand str(x) returning unicode
5b4f08
-                obj = notice.__str__()
5b4f08
-
5b4f08
-            if list_type == 'all':
5b4f08
-                if _rpm_tup_vercmp(iname2tup[pkgtup[0]], pkgtup) >= 0:
5b4f08
-                    obj = obj + "\n  Installed : true"
5b4f08
-                else:
5b4f08
-                    obj = obj + "\n  Installed : false"
5b4f08
-            msg(obj)
5b4f08
-
5b4f08
-    def summary_show_pkgs(self, base, md_info, list_type, show_type,
5b4f08
-                          iname2tup, data, msg):
5b4f08
-        def _msg(x):
5b4f08
-            print x
5b4f08
-        counts = {}
5b4f08
-        sev_counts = {}
5b4f08
-        show_pkg_info_done = {}
5b4f08
-        for (notice, pkgtup, pkg) in data:
5b4f08
-            if notice['update_id'] in show_pkg_info_done:
5b4f08
-                continue
5b4f08
-            show_pkg_info_done[notice['update_id']] = notice
5b4f08
-            counts[notice['type']] = counts.get(notice['type'], 0) + 1
5b4f08
-            if notice['type'] == 'security':
5b4f08
-                sev = notice['severity']
5b4f08
-                if sev is None:
5b4f08
-                    sev = ''
5b4f08
-                sev_counts[sev] = sev_counts.get(sev, 0) + 1
5b4f08
-
5b4f08
-        maxsize = 0
5b4f08
-        for T in ('newpackage', 'security', 'bugfix', 'enhancement'):
5b4f08
-            if T not in counts:
5b4f08
-                continue
5b4f08
-            size = len(str(counts[T]))
5b4f08
-            if maxsize < size:
5b4f08
-                maxsize = size
5b4f08
-        if not maxsize:
5b4f08
-            _check_running_kernel(base, md_info, _msg)
5b4f08
-            return
5b4f08
-
5b4f08
-        outT = {'newpackage' : 'New Package',
5b4f08
-                'security' : 'Security',
5b4f08
-                'bugfix' : 'Bugfix',
5b4f08
-                'enhancement' : 'Enhancement'}
5b4f08
-        print "Updates Information Summary:", list_type
5b4f08
-        for T in ('newpackage', 'security', 'bugfix', 'enhancement'):
5b4f08
-            if T not in counts:
5b4f08
-                continue
5b4f08
-            n = outT[T]
5b4f08
-            if T == 'security' and len(sev_counts) == 1:
5b4f08
-                sn = sev_counts.keys()[0]
5b4f08
-                if sn != '':
5b4f08
-                    n = sn + " " + n
5b4f08
-            print "    %*u %s notice(s)" % (maxsize, counts[T], n)
5b4f08
-            if T == 'security' and len(sev_counts) != 1:
5b4f08
-                def _sev_sort_key(key):
5b4f08
-                    # We want these in order, from "highest" to "lowest".
5b4f08
-                    # Anything unknown is "higher". meh.
5b4f08
-                    return {'Critical' : "zz1",
5b4f08
-                            'Important': "zz2",
5b4f08
-                            'Moderate' : "zz3",
5b4f08
-                            'Low'      : "zz4",
5b4f08
-                            }.get(key, key)
5b4f08
-
5b4f08
-                for sn in sorted(sev_counts, key=_sev_sort_key):
5b4f08
-                    args = (maxsize, sev_counts[sn],sn or '?', outT['security'])
5b4f08
-                    print "        %*u %s %s notice(s)" % args
5b4f08
-        _check_running_kernel(base, md_info, _msg)
5b4f08
-        self.show_pkg_info_done = {}
5b4f08
-
5b4f08
-    def _get_new_pkgs(self, md_info):
5b4f08
-        for notice in md_info.notices:
5b4f08
-            if notice['type'] != "newpackage":
5b4f08
-                continue
5b4f08
-            for upkg in notice['pkglist']:
5b4f08
-                for pkg in upkg['packages']:
5b4f08
-                    pkgtup = (pkg['name'], pkg['arch'], pkg['epoch'] or '0',
5b4f08
-                              pkg['version'], pkg['release'])
5b4f08
-                    yield (notice, pkgtup)
5b4f08
-
5b4f08
-    _cmd2filt = {"bugzillas" : "bugzilla",
5b4f08
-                 "bugzilla" : "bugzilla",
5b4f08
-                 "bzs" : "bugzilla",
5b4f08
-                 "bz" : "bugzilla",
5b4f08
-
5b4f08
-                 "sec" : "security",
5b4f08
-
5b4f08
-                 "cves" : "cve",
5b4f08
-                 "cve" : "cve",
5b4f08
-
5b4f08
-                 "newpackages" : "newpackage",
5b4f08
-                 "new-packages" : "newpackage",
5b4f08
-                 "newpackage" : "newpackage",
5b4f08
-                 "new-package" : "newpackage",
5b4f08
-                 "new" : "newpackage"}
5b4f08
-    for filt_type in __update_info_types__:
5b4f08
-        _cmd2filt[filt_type] = filt_type
5b4f08
-
5b4f08
-    def doCommand(self, base, basecmd, extcmds):
5b4f08
-        if basecmd in self.direct_cmds:
5b4f08
-            subcommand = self.direct_cmds[basecmd]
5b4f08
-        elif extcmds and extcmds[0] in ('list', 'info', 'summary'):
5b4f08
-            subcommand = extcmds[0]
5b4f08
-            extcmds = extcmds[1:]
5b4f08
-        elif extcmds and extcmds[0] in self._cmd2filt:
5b4f08
-            subcommand = 'list'
5b4f08
-        elif extcmds:
5b4f08
-            subcommand = 'info'
5b4f08
-        else:
5b4f08
-            subcommand = 'summary'
5b4f08
-
5b4f08
-        if subcommand == 'list':
5b4f08
-            return self.doCommand_li(base, 'updateinfo list', extcmds,
5b4f08
-                                     self.list_show_pkgs)
5b4f08
-        if subcommand == 'info':
5b4f08
-            return self.doCommand_li(base, 'updateinfo info', extcmds,
5b4f08
-                                     self.info_show_pkgs)
5b4f08
-
5b4f08
-        if subcommand == 'summary':
5b4f08
-            return self.doCommand_li(base, 'updateinfo summary', extcmds,
5b4f08
-                                     self.summary_show_pkgs)
5b4f08
-
5b4f08
-    def doCommand_li_new(self, base, list_type, extcmds, md_info, msg,
5b4f08
-                         show_pkgs):
5b4f08
-        done_pkgs = set()
5b4f08
-        data = []
5b4f08
-        for (notice, pkgtup) in sorted(self._get_new_pkgs(md_info),
5b4f08
-                                       key=lambda x: x[1][0]):
5b4f08
-            if extcmds and not _match_sec_cmd(extcmds, pkgtup[0], notice):
5b4f08
-                continue
5b4f08
-            n = pkgtup[0]
5b4f08
-            if n in done_pkgs:
5b4f08
-                continue
5b4f08
-            ipkgs = list(reversed(sorted(base.rpmdb.searchNames([n]))))
5b4f08
-            if list_type in ('installed', 'updates') and not ipkgs:
5b4f08
-                done_pkgs.add(n)
5b4f08
-                continue
5b4f08
-            if list_type == 'available' and ipkgs:
5b4f08
-                done_pkgs.add(n)
5b4f08
-                continue
5b4f08
-
5b4f08
-            pkgs = base.pkgSack.searchPkgTuple(pkgtup)
5b4f08
-            if not pkgs:
5b4f08
-                continue
5b4f08
-            if list_type == "updates" and pkgs[0].verLE(ipkgs[0]):
5b4f08
-                done_pkgs.add(n)
5b4f08
-                continue
5b4f08
-            done_pkgs.add(n)
5b4f08
-            data.append((notice, pkgtup, pkgs[0]))
5b4f08
-        show_pkgs(base, md_info, list_type, None, {}, data, msg)
5b4f08
-
5b4f08
-    def _parse_extcmds(self, extcmds):
5b4f08
-        filt_type = None
5b4f08
-        show_type = None
5b4f08
-        if len(extcmds) >= 1:
5b4f08
-            filt_type = None
5b4f08
-            
5b4f08
-            if extcmds[0] in self._cmd2filt:
5b4f08
-                filt_type = self._cmd2filt[extcmds.pop(0)]
5b4f08
-            show_type = filt_type
5b4f08
-            if filt_type and filt_type in __update_info_types__:
5b4f08
-                show_type = None
5b4f08
-        return extcmds, show_type, filt_type
5b4f08
-
5b4f08
-    def doCommand_li(self, base, basecmd, extcmds, show_pkgs):
5b4f08
-        self.repos = base.repos
5b4f08
-        md_info = ysp_gen_metadata(self.repos.listEnabled())
5b4f08
-        def msg(x):
5b4f08
-            #  Don't use: logger.log(logginglevels.INFO_2, x)
5b4f08
-            # or -q deletes everything.
5b4f08
-            print x
5b4f08
-
5b4f08
-        opts, cmdline = base.plugins.cmdline
5b4f08
-        extcmds, show_type, filt_type = self._parse_extcmds(extcmds)
5b4f08
-
5b4f08
-        list_type = "available"
5b4f08
-        if extcmds and extcmds[0] in ("updates","available","installed", "all"):
5b4f08
-            list_type = extcmds.pop(0)
5b4f08
-
5b4f08
-        if filt_type == "newpackage":
5b4f08
-            # No filtering here, as we want what isn't installed...
5b4f08
-            self.doCommand_li_new(base, list_type, extcmds, md_info, msg,
5b4f08
-                                  show_pkgs)
5b4f08
-            return 0, [basecmd + ' new done']
5b4f08
-
5b4f08
-        opts.sec_cmds = extcmds
5b4f08
-        used_map = ysp_gen_used_map(opts)
5b4f08
-        iname2tup = {}
5b4f08
-        if False: pass
5b4f08
-        elif list_type in ('installed', 'all'):
5b4f08
-            name2tup = _get_name2allpkgtup(base)
5b4f08
-            iname2tup = _get_name2instpkgtup(base)
5b4f08
-        elif list_type == 'updates':
5b4f08
-            name2tup = _get_name2oldpkgtup(base)
5b4f08
-        elif list_type == 'available':
5b4f08
-            name2tup = _get_name2instpkgtup(base)
5b4f08
-
5b4f08
-        def _show_pkgtup(pkgtup):
5b4f08
-            name = pkgtup[0]
5b4f08
-            notices = reversed(md_info.get_applicable_notices(pkgtup))
5b4f08
-            for (pkgtup, notice) in notices:
5b4f08
-                if filt_type and not ysp_has_info_md(filt_type, notice):
5b4f08
-                    continue
5b4f08
-
5b4f08
-                if list_type == 'installed':
5b4f08
-                    # Remove any that are newer than what we have installed
5b4f08
-                    if _rpm_tup_vercmp(iname2tup[name], pkgtup) < 0:
5b4f08
-                        continue
5b4f08
-
5b4f08
-                if ysp_should_filter_pkg(opts, name, notice, used_map):
5b4f08
-                    yield (pkgtup, notice)
5b4f08
-
5b4f08
-        data = []
5b4f08
-        for pkgname in sorted(name2tup):
5b4f08
-            for (pkgtup, notice) in _show_pkgtup(name2tup[pkgname]):
5b4f08
-                d = {}
5b4f08
-                (d['n'], d['a'], d['e'], d['v'], d['r']) = pkgtup
5b4f08
-                if d['e'] == '0':
5b4f08
-                    d['epoch'] = ''
5b4f08
-                else:
5b4f08
-                    d['epoch'] = "%s:" % d['e']
5b4f08
-                data.append((notice, pkgtup,
5b4f08
-                            "%(n)s-%(epoch)s%(v)s-%(r)s.%(a)s" % d))
5b4f08
-        show_pkgs(base, md_info, list_type, show_type, iname2tup, data, msg)
5b4f08
-
5b4f08
-        ysp_chk_used_map(used_map, msg)
5b4f08
-
5b4f08
-        return 0, [basecmd + ' done']
5b4f08
-            
5b4f08
-
5b4f08
-# "Borrowed" from yumcommands.py
5b4f08
-def yumcommands_checkRootUID(base):
5b4f08
-    """
5b4f08
-    Verify that the program is being run by the root user.
5b4f08
-
5b4f08
-    @param base: a YumBase object.
5b4f08
-    """
5b4f08
-    if base.conf.uid != 0:
5b4f08
-        base.logger.critical('You need to be root to perform this command.')
5b4f08
-        raise CliError
5b4f08
-def yumcommands_checkGPGKey(base):
5b4f08
-    if not base.gpgKeyCheck():
5b4f08
-        for repo in base.repos.listEnabled():
5b4f08
-            if repo.gpgcheck != 'false' and repo.gpgkey == '':
5b4f08
-                msg = """
5b4f08
-You have enabled checking of packages via GPG keys. This is a good thing. 
5b4f08
-However, you do not have any GPG public keys installed. You need to download
5b4f08
-the keys for packages you wish to install and install them.
5b4f08
-You can do that by running the command:
5b4f08
-    rpm --import public.gpg.key
5b4f08
-
5b4f08
-
5b4f08
-Alternatively you can specify the url to the key you would like to use
5b4f08
-for a repository in the 'gpgkey' option in a repository section and yum 
5b4f08
-will install it for you.
5b4f08
-
5b4f08
-For more information contact your distribution or package provider.
5b4f08
-"""
5b4f08
-                base.logger.critical(msg)
5b4f08
-                raise CliError
5b4f08
-
5b4f08
-def _get_name2pkgtup(base, pkgtups):
5b4f08
-    name2tup = {}
5b4f08
-    for pkgtup in pkgtups:
5b4f08
-        # Get the latest "old" pkgtups
5b4f08
-        if (pkgtup[0] in name2tup and
5b4f08
-            _rpm_tup_vercmp(name2tup[pkgtup[0]], pkgtup) > 0):
5b4f08
-            continue
5b4f08
-        name2tup[pkgtup[0]] = pkgtup
5b4f08
-    return name2tup
5b4f08
-def _get_name2oldpkgtup(base):
5b4f08
-    """ Get the pkgtups for all installed pkgs. which have an update. """
5b4f08
-    oupdates = map(lambda x: x[1], base.up.getUpdatesTuples())
5b4f08
-    return _get_name2pkgtup(base, oupdates)
5b4f08
-def _get_name2instpkgtup(base):
5b4f08
-    """ Get the pkgtups for all installed pkgs. """
5b4f08
-    return _get_name2pkgtup(base, base.rpmdb.simplePkgList())
5b4f08
-def _get_name2allpkgtup(base):
5b4f08
-    """ Get the pkgtups for all installed pkgs. and munge that to be the
5b4f08
-        first possible pkgtup. """
5b4f08
-    ofirst = [(pt[0], pt[1], '0','0','0') for pt in base.rpmdb.simplePkgList()]
5b4f08
-    return _get_name2pkgtup(base, ofirst)
5b4f08
-
5b4f08
-
5b4f08
-
5b4f08
-class SecurityUpdateCommand:
5b4f08
-    def getNames(self):
5b4f08
-        return ['update-minimal']
5b4f08
-
5b4f08
-    def getUsage(self):
5b4f08
-        return "[PACKAGE-wildcard]"
5b4f08
-
5b4f08
-    def getSummary(self):
5b4f08
-        return "Works like update, but goes to the 'newest' package match which fixes a problem that affects your system"
5b4f08
-
5b4f08
-    def doCheck(self, base, basecmd, extcmds):
5b4f08
-        yumcommands_checkRootUID(base)
5b4f08
-        yumcommands_checkGPGKey(base)
5b4f08
-
5b4f08
-    def doCommand(self, base, basecmd, extcmds):
5b4f08
-        if hasattr(base, 'run_with_package_names'):
5b4f08
-            base.run_with_package_names.add(__package_name__)
5b4f08
-        md_info       = ysp_gen_metadata(base.repos.listEnabled())
5b4f08
-        opts          = base.plugins.cmdline[0]
5b4f08
-        opts.sec_cmds = []
5b4f08
-        used_map      = ysp_gen_used_map(opts)
5b4f08
-
5b4f08
-        ndata = not (opts.security or opts.bugfixes or
5b4f08
-                     opts.advisory or opts.bz or opts.cve or opts.severity)
5b4f08
-
5b4f08
-        # NOTE: Not doing obsoletes processing atm. ... maybe we should? --
5b4f08
-        # Also worth pointing out we don't go backwards for obsoletes in the:
5b4f08
-        # update --security case etc.
5b4f08
-
5b4f08
-        # obsoletes = base.up.getObsoletesTuples(newest=False)
5b4f08
-        # for (obsoleting, installed) in sorted(obsoletes, key=lambda x: x[0]):
5b4f08
-        #   pass
5b4f08
-
5b4f08
-        # Tuples == (n, a, e, v, r)
5b4f08
-        oupdates  = map(lambda x: x[1], base.up.getUpdatesTuples())
5b4f08
-        for oldpkgtup in sorted(oupdates):
5b4f08
-            data = md_info.get_applicable_notices(oldpkgtup)
5b4f08
-            if ndata: # No options means pick the oldest update
5b4f08
-                data.reverse()
5b4f08
-
5b4f08
-            for (pkgtup, notice) in data:
5b4f08
-                name = pkgtup[0]
5b4f08
-                if extcmds and not _match_sec_cmd(extcmds, name, notice):
5b4f08
-                    continue
5b4f08
-                if (not ndata and
5b4f08
-                    not ysp_should_filter_pkg(opts, name, notice, used_map)):
5b4f08
-                    continue
5b4f08
-                base.update(name=pkgtup[0], arch=pkgtup[1], epoch=pkgtup[2],
5b4f08
-                            version=pkgtup[3], release=pkgtup[4])
5b4f08
-                break
5b4f08
-
5b4f08
-        if len(base.tsInfo) > 0:
5b4f08
-            msg = '%d packages marked for minimal Update' % len(base.tsInfo)
5b4f08
-            return 2, [msg]
5b4f08
-        else:
5b4f08
-            return 0, ['No Packages marked for minimal Update']
5b4f08
-
5b4f08
-def config_hook(conduit):
5b4f08
-    '''
5b4f08
-    Yum Plugin Config Hook: 
5b4f08
-    Setup the option parser with the '--advisory', '--bz', '--cve',
5b4f08
-    '--security' and '--severity' command line options. Also the 'updateinfo'
5b4f08
-    and 'update-minimal' commands.
5b4f08
-    '''
5b4f08
-
5b4f08
-    parser = conduit.getOptParser()
5b4f08
-    if not parser:
5b4f08
-        return
5b4f08
-
5b4f08
-    if hasattr(parser, 'plugin_option_group'):
5b4f08
-        parser = parser.plugin_option_group
5b4f08
-
5b4f08
-    conduit.registerCommand(UpdateinfoCommand())
5b4f08
-    conduit.registerCommand(SecurityUpdateCommand())
5b4f08
-    def osec(opt, key, val, parser):
5b4f08
-         # CVE is a subset of --security on RHEL, but not on Fedora
5b4f08
-        parser.values.security = True
5b4f08
-    def obug(opt, key, val, parser):
5b4f08
-        parser.values.bugfixes = True
5b4f08
-    def ocve(opt, key, val, parser):
5b4f08
-        parser.values.cve.extend(val.split(','))
5b4f08
-    def obz(opt, key, val, parser):
5b4f08
-        parser.values.bz.append(str(val))
5b4f08
-    def oadv(opt, key, val, parser):
5b4f08
-        parser.values.advisory.extend(val.split(','))
5b4f08
-    def osev(opt, key, val, parser):
5b4f08
-        parser.values.severity.extend(val.split(','))
5b4f08
-            
5b4f08
-    parser.add_option('--security', action="callback",
5b4f08
-                      callback=osec, dest='security', default=False,
5b4f08
-                      help='Include security relevant packages')
5b4f08
-    parser.add_option('--bugfixes', action="callback",
5b4f08
-                      callback=obug, dest='bugfixes', default=False,
5b4f08
-                      help='Include bugfix relevant packages')
5b4f08
-    parser.add_option('--cve', action="callback", type="string",
5b4f08
-                      callback=ocve, dest='cve', default=[],
5b4f08
-                      help='Include packages needed to fix the given CVE')
5b4f08
-    parser.add_option('--bz', action="callback",
5b4f08
-                      callback=obz, dest='bz', default=[], type="int",
5b4f08
-                      help='Include packages needed to fix the given BZ')
5b4f08
-    parser.add_option('--sec-severity', action="callback",
5b4f08
-                      callback=osev, dest='severity', default=[], type="string",
5b4f08
-                      help='Include security relevant packages, of this severity')
5b4f08
-    parser.add_option('--advisory', action="callback",
5b4f08
-                      callback=oadv, dest='advisory', default=[], type="string",
5b4f08
-                      help='Include packages needed to fix the given advisory')
5b4f08
-
5b4f08
-#  You might think we'd just use the exclude_hook, and call delPackage
5b4f08
-# and indeed that works for list updates etc.
5b4f08
-#
5b4f08
-# __but__ that doesn't work for dependancies on real updates
5b4f08
-#
5b4f08
-#  So to fix deps. we need to do it at the preresolve stage and take the
5b4f08
-# "transaction package list" and then remove packages from that.
5b4f08
-#
5b4f08
-# __but__ that doesn't work for lists ... so we do it two ways
5b4f08
-#
5b4f08
-def ysp_should_keep_pkg(opts, pkgtup, md_info, used_map):
5b4f08
-    """ Do we want to keep this package to satisfy the security limits. """
5b4f08
-    name = pkgtup[0]
5b4f08
-    for (pkgtup, notice) in md_info.get_applicable_notices(pkgtup):
5b4f08
-        if ysp_should_filter_pkg(opts, name, notice, used_map):
5b4f08
-            return True
5b4f08
-    return False
5b4f08
-
5b4f08
-def ysp_check_func_enter(conduit):
5b4f08
-    """ Stuff we need to do in both list and update modes. """
5b4f08
-    
5b4f08
-    opts, args = conduit.getCmdLine()
5b4f08
-
5b4f08
-    ndata = not (opts.security or opts.bugfixes or
5b4f08
-                 opts.advisory or opts.bz or opts.cve or opts.severity)
5b4f08
-    
5b4f08
-    ret = None
5b4f08
-    if len(args) >= 2:
5b4f08
-        if ((args[0] == "list") and (args[1] in ("obsoletes", "updates"))):
5b4f08
-            ret = {"skip": ndata, "list_cmd": True}
5b4f08
-        if ((args[0] == "info") and (args[1] in ("obsoletes", "updates"))):
5b4f08
-            ret = {"skip": ndata, "list_cmd": True}
5b4f08
-    if len(args):
5b4f08
-
5b4f08
-        # All the args. stuff is done in our command:
5b4f08
-        if (args[0] == "update-minimal"):
5b4f08
-            return (opts, {"skip": True, "list_cmd": False, "msg": True})
5b4f08
-            
5b4f08
-        if (args[0] == "check-update"):
5b4f08
-            ret = {"skip": ndata, "list_cmd": True}
5b4f08
-        if (args[0] in ["update", "upgrade"]):
5b4f08
-            ret = {"skip": ndata, "list_cmd": False}
5b4f08
-        if args[0] == 'updateinfo':
5b4f08
-            return (opts, {"skip": True, "list_cmd": True})
5b4f08
-        if (args[0] in UpdateinfoCommand.direct_cmds):
5b4f08
-            return (opts, {"skip": True, "list_cmd": True})
5b4f08
-
5b4f08
-    if ret:
5b4f08
-        return (opts, ret)
5b4f08
-    
5b4f08
-    if not ndata:
5b4f08
-        conduit.error(2, 'Skipping security plugin, other command')
5b4f08
-    return (opts, {"skip": True, "list_cmd": False, "msg": True})
5b4f08
-
5b4f08
-def exclude_hook(conduit):
5b4f08
-    '''
5b4f08
-    Yum Plugin Exclude Hook:
5b4f08
-    Check and remove packages that don\'t align with the security config.
5b4f08
-    '''
5b4f08
-    
5b4f08
-    opts, info = ysp_check_func_enter(conduit)
5b4f08
-    if info["skip"]:
5b4f08
-        return
5b4f08
-
5b4f08
-    if not info["list_cmd"]:
5b4f08
-        return
5b4f08
-    
5b4f08
-    if hasattr(conduit, 'registerPackageName'):
5b4f08
-        conduit.registerPackageName(__package_name__)
5b4f08
-    conduit.info(2, 'Limiting package lists to security relevant ones')
5b4f08
-    
5b4f08
-    md_info = ysp_gen_metadata(conduit.getRepos().listEnabled())
5b4f08
-
5b4f08
-    def ysp_del_pkg(pkg):
5b4f08
-        """ Deletes a package from all trees that yum knows about """
5b4f08
-        conduit.info(3," --> %s from %s excluded (non-security)" %
5b4f08
-                     (pkg,pkg.repoid))
5b4f08
-        conduit.delPackage(pkg)
5b4f08
-
5b4f08
-    opts.sec_cmds = []
5b4f08
-    used_map = ysp_gen_used_map(opts)
5b4f08
-
5b4f08
-    # The official API is:
5b4f08
-    #
5b4f08
-    # pkgs = conduit.getPackages()
5b4f08
-    #
5b4f08
-    # ...however that is _extremely_ slow, deleting all packages. So we ask
5b4f08
-    # for the list of update packages, which is all we care about.    
5b4f08
-    upds = conduit._base.doPackageLists(pkgnarrow='updates')
5b4f08
-    pkgs = upds.updates
5b4f08
-    # In theory we don't need to do this in some cases, but meh.
5b4f08
-    upds = conduit._base.doPackageLists(pkgnarrow='obsoletes')
5b4f08
-    pkgs += upds.obsoletes
5b4f08
-
5b4f08
-    name2tup = _get_name2oldpkgtup(conduit._base)
5b4f08
-    
5b4f08
-    tot = 0
5b4f08
-    cnt = 0
5b4f08
-    for pkg in pkgs:
5b4f08
-        tot += 1
5b4f08
-        name = pkg.name
5b4f08
-        if (name not in name2tup or
5b4f08
-            not ysp_should_keep_pkg(opts, name2tup[name], md_info, used_map)):
5b4f08
-            ysp_del_pkg(pkg)
5b4f08
-            continue
5b4f08
-        cnt += 1
5b4f08
-
5b4f08
-    ysp_chk_used_map(used_map, lambda x: conduit.error(2, x))
5b4f08
-    if cnt:
5b4f08
-        conduit.info(2, '%d package(s) needed for security, out of %d available' % (cnt, tot))
5b4f08
-    else:
5b4f08
-        conduit.info(2, 'No packages needed for security; %d packages available' % tot)
5b4f08
-
5b4f08
-    _check_running_kernel(conduit._base, md_info, lambda x: conduit.info(2, x))
5b4f08
-
5b4f08
-def _check_running_kernel(yb, md_info, msg):
5b4f08
-    if not hasattr(yum.misc, 'get_running_kernel_pkgtup'):
5b4f08
-        return # Back compat.
5b4f08
-
5b4f08
-    kern_pkgtup = yum.misc.get_running_kernel_pkgtup(yb.ts)
5b4f08
-    if kern_pkgtup[0] is None:
5b4f08
-        return
5b4f08
-
5b4f08
-    found_sec = False
5b4f08
-    for (pkgtup, notice) in md_info.get_applicable_notices(kern_pkgtup):
5b4f08
-        if found_sec or notice['type'] != 'security':
5b4f08
-            continue
5b4f08
-        found_sec = True
5b4f08
-        ipkg = yb.rpmdb.searchPkgTuple(pkgtup)
5b4f08
-        if not ipkg:
5b4f08
-            continue # Not installed
5b4f08
-        ipkg = ipkg[0]
5b4f08
-
5b4f08
-        e = ''
5b4f08
-        if kern_pkgtup[2] != '0':
5b4f08
-            e = '%s:' % kern_pkgtup[2]
5b4f08
-        rpkg = '%s-%s%s-%s.%s' % (kern_pkgtup[0], e,
5b4f08
-                                  kern_pkgtup[3], kern_pkgtup[4],
5b4f08
-                                  kern_pkgtup[1])
5b4f08
-
5b4f08
-        msg('Security: %s is an installed security update' % ipkg)
5b4f08
-        msg('Security: %s is the currently running version' % rpkg)
5b4f08
-        break
5b4f08
-
5b4f08
-
5b4f08
-def preresolve_hook(conduit):
5b4f08
-    '''
5b4f08
-    Yum Plugin PreResolve Hook:
5b4f08
-    Check and remove packages that don\'t align with the security config.
5b4f08
-    '''
5b4f08
-
5b4f08
-    opts, info = ysp_check_func_enter(conduit)
5b4f08
-    if info["skip"]:
5b4f08
-        return
5b4f08
-
5b4f08
-    if info["list_cmd"]:
5b4f08
-        return
5b4f08
-    
5b4f08
-    if hasattr(conduit, 'registerPackageName'):
5b4f08
-        conduit.registerPackageName(__package_name__)
5b4f08
-    conduit.info(2, 'Limiting packages to security relevant ones')
5b4f08
-
5b4f08
-    md_info = ysp_gen_metadata(conduit.getRepos().listEnabled())
5b4f08
-
5b4f08
-    def ysp_del_pkg(tspkg):
5b4f08
-        """ Deletes a package within a transaction. """
5b4f08
-        conduit.info(3," --> %s from %s excluded (non-security)" %
5b4f08
-                     (tspkg.po,tspkg.po.repoid))
5b4f08
-        tsinfo.remove(tspkg.pkgtup)
5b4f08
-
5b4f08
-    tot = 0
5b4f08
-    cnt = 0
5b4f08
-    opts.sec_cmds = []
5b4f08
-    used_map = ysp_gen_used_map(opts)
5b4f08
-    tsinfo = conduit.getTsInfo()
5b4f08
-    tspkgs = tsinfo.getMembers()
5b4f08
-    #  Ok, here we keep any pkgs that pass "ysp" tests, then we keep all
5b4f08
-    # related pkgs ... Ie. "installed" version marked for removal.
5b4f08
-    keep_pkgs = set()
5b4f08
-
5b4f08
-    count_states = set(TS_INSTALL_STATES + [TS_ERASE])
5b4f08
-    count_pkgs = set()
5b4f08
-    for tspkg in tspkgs:
5b4f08
-        if tspkg.output_state in count_states:
5b4f08
-            count_pkgs.add(tspkg.po)
5b4f08
-
5b4f08
-    name2tup = _get_name2oldpkgtup(conduit._base)
5b4f08
-    for tspkg in tspkgs:
5b4f08
-        if tspkg.output_state in count_states:
5b4f08
-            tot += 1
5b4f08
-        name = tspkg.po.name
5b4f08
-        if (name not in name2tup or
5b4f08
-            not ysp_should_keep_pkg(opts, name2tup[name], md_info, used_map)):
5b4f08
-            continue
5b4f08
-        if tspkg.output_state in count_states:
5b4f08
-            cnt += 1
5b4f08
-        keep_pkgs.add(tspkg.po)
5b4f08
-
5b4f08
-    scnt = cnt
5b4f08
-    mini_depsolve_again = True
5b4f08
-    while mini_depsolve_again:
5b4f08
-        mini_depsolve_again = False
5b4f08
-
5b4f08
-        for tspkg in tspkgs:
5b4f08
-            if tspkg.po in keep_pkgs:
5b4f08
-                # Find any related pkgs, and add them:
5b4f08
-                for (rpkg, reason) in tspkg.relatedto:
5b4f08
-                    if rpkg not in keep_pkgs:
5b4f08
-                        if rpkg in count_pkgs:
5b4f08
-                            cnt += 1
5b4f08
-                        keep_pkgs.add(rpkg)
5b4f08
-                        mini_depsolve_again = True
5b4f08
-            else:
5b4f08
-                # If related to any keep pkgs, add us
5b4f08
-                for (rpkg, reason) in tspkg.relatedto:
5b4f08
-                    if rpkg in keep_pkgs:
5b4f08
-                        if rpkg in count_pkgs:
5b4f08
-                            cnt += 1
5b4f08
-                        keep_pkgs.add(tspkg.po)
5b4f08
-                        mini_depsolve_again = True
5b4f08
-                        break
5b4f08
-
5b4f08
-    for tspkg in tspkgs:
5b4f08
-        if tspkg.po not in keep_pkgs:
5b4f08
-            ysp_del_pkg(tspkg)
5b4f08
-
5b4f08
-    ysp_chk_used_map(used_map, lambda x: conduit.error(2, x))
5b4f08
-    
5b4f08
-    if cnt:
5b4f08
-        conduit.info(2, '%d package(s) needed (+%d related) for security, out of %d available' % (scnt, cnt - scnt, tot))
5b4f08
-    else:
5b4f08
-        conduit.info(2, 'No packages needed for security; %d packages available' % tot)
5b4f08
-
5b4f08
-if __name__ == '__main__':
5b4f08
-    print "This is a plugin that is supposed to run from inside YUM"
5b4f08
diff --git a/po/POTFILES.in b/po/POTFILES.in
5b4f08
index d85030c..2f12118 100644
5b4f08
--- a/po/POTFILES.in
5b4f08
+++ b/po/POTFILES.in
5b4f08
@@ -34,7 +34,6 @@ plugins/merge-conf/merge-conf.py
5b4f08
 plugins/aliases/aliases.py
5b4f08
 plugins/protectbase/protectbase.py
5b4f08
 plugins/versionlock/versionlock.py
5b4f08
-plugins/security/security.py
5b4f08
 plugins/nofsync/nofsync.py
5b4f08
 plugins/tmprepo/tmprepo.py
5b4f08
 plugins/priorities/priorities.py
5b4f08
diff --git a/yum-utils.spec b/yum-utils.spec
5b4f08
index 6d6d699..de6fbfd 100644
5b4f08
--- a/yum-utils.spec
5b4f08
+++ b/yum-utils.spec
5b4f08
@@ -155,20 +155,6 @@ This yum plugin adds the "--merge-conf" command line option. With this option,
5b4f08
 Yum will ask you what to do with config files which have changed on updating a
5b4f08
 package.
5b4f08
 
5b4f08
-%package -n yum-plugin-security
5b4f08
-Summary: Yum plugin to enable security filters
5b4f08
-Group: System Environment/Base
5b4f08
-Provides: yum-security = %{version}-%{release}
5b4f08
-Obsoletes: yum-security < 1.1.20-0
5b4f08
-Conflicts: yum-security < 1.1.20-0
5b4f08
-Requires: yum >= 3.2.18
5b4f08
-
5b4f08
-%description -n yum-plugin-security
5b4f08
-This plugin adds the options --security, --cve, --bz and --advisory flags
5b4f08
-to yum and the list-security and info-security commands.
5b4f08
-The options make it possible to limit list/upgrade of packages to specific
5b4f08
-security relevant ones. The commands give you the security information.
5b4f08
-
5b4f08
 %package -n yum-plugin-upgrade-helper
5b4f08
 Summary: Yum plugin to help upgrades to the next distribution version
5b4f08
 Group: System Environment/Base
5b4f08
@@ -396,7 +382,6 @@ plugins="\
5b4f08
  tsflags \
5b4f08
  priorities \
5b4f08
  merge-conf \
5b4f08
- security \
5b4f08
  upgrade-helper \
5b4f08
  aliases \
5b4f08
  list-data \
5b4f08
@@ -565,13 +550,6 @@ fi
5b4f08
 %config(noreplace) %{_sysconfdir}/yum/pluginconf.d/merge-conf.conf
5b4f08
 %{pluginhome}/merge-conf.*
5b4f08
 
5b4f08
-%files -n yum-plugin-security
5b4f08
-%defattr(-, root, root)
5b4f08
-%doc COPYING
5b4f08
-%config(noreplace) %{_sysconfdir}/yum/pluginconf.d/security.conf
5b4f08
-%{pluginhome}/security.*
5b4f08
-%{_mandir}/man8/yum-security.8.*
5b4f08
-
5b4f08
 %files -n yum-plugin-upgrade-helper
5b4f08
 %defattr(-, root, root)
5b4f08
 %doc COPYING