Just to recap the latest in the #Redhat RHEL vs downstreams not offering them any value drama:

Redhat publically states that downstream rebuilders offer them no value, and the RHEL community should all be working in the Centos-stream sandbox, because that's where the community is, because it has community right there in the name, and that's where the code fixes can land, and community is only about lines of code in the repo.

@almalinux goes "alright, no value in us being a 1:1 rebuild of RHEL, then we're cutting our own path while being based on Centos-stream, staying ABI compatible with RHEL, but we'll fix our own bugs when we find them"

Alma Linux then finds a CVE in the iperf3 server impacting everyone in the Enterprise Linux 9 ecosystem, so they release the fix for AlmaLinux, and then immediately open pull requests for Fedora and Centos-stream to land the fix upstream. Which would seem to be exactly what Redhat was asking for this whole time.

Redhat's response to the centos-stream pull request? "There is no current customer demand for this fix in RHEL, so we're not interested in this fix"

The astute will notice that the pull request is feeding into centos-stream, and not RHEL. But they're making merge decisions here based on immediate customer demand in RHEL.

So maybe this whole "Centos-stream is the community distro" line was bullshit and it really is just the beta testing ground for RHEL, just like all of us kind of thought it was while getting shouted down by the centos-stream advocates this whole time.

So Redhat is still doing great.

https://gitlab.com/redhat/centos-stream/rpms/iperf3/-/merge_requests/5

Fixes CVE-2023-38403 - Resolves: rhbz#2223729 (!5) · Merge requests · Red Hat / centos-stream / rpms / iperf3 · GitLab

Summary of Changes Fixes CVE-2023-38403 Approved Development Ticket

GitLab

@kwf @almalinux And this is why a hard fork from SUSE and AlmaLinux diverging to be ABI are a great thing.

AlmaLinux can submit patches, but if IBM doesn't want them, fine. Let their customers ask why AlmaLinux is getting patches and bug fixes faster than RHEL.

I'm hoping with this direction change, AlmaLinux can start shipping some updated packages by default. Like it's asinine that RHEL ships PHP 7.2 (!!!) in 8.8 but Ubuntu 22.04 ships PHP 8.1. There's a difference between shipping stable software and shipping ancient history.

@travis @kwf @almalinux RHEL customers asking for this because Alma has it would be a great outcome. The maintainer specifically mentioned customer feedback/demand. But really it's probably going to depend more on the severity rating it ends up with (it doesn't have one yet).

@travis @kwf @almalinux RHEL 8 has PHP 7.2 as default, but also has optional 7.3, 7.4, and 8.0. It doesn't make sense to compare the default PHP version of a distro released in 2019 with the default PHP version of a distro released in 2022. RHEL 9, which was released in 2022, has PHP 8.0 as the default, with optional 8.1.

Alma could ship additional optional PHP versions, but changing the default PHP version would break the ABI compatibility they're aiming for.