Kernel updates in Mandrake

urpmi doesn't list them

[encyclo]

I'm subscribed to the mailing list for Mandrake security updates, and I've noticed that kernel updates are not listed when I use the Mandrake Update tool. I don't believe this is an isolated problem, and it appears that Mandrake don't offer kernel updates for automatic download via a graphical interface. To get the rpm, you have to use urpmi from the command line, and you have to know the specific version number of the kernel rpm that you want to install. What's more, the instructions on how to install the kernel update on the Mandrake site (found using the link in the security notice!) are clearly out of date and inaccurate.

This looks to be a serious failure in the Mandrake updating process - if I wasn't subscribed to the mailing list, I would never know that there were updates, and I would be left running a kernel with known, published vulnerabilities. The original kernel on the install disks for 9.1 is 2.4.21 version 13, and they're now up to version 32! As Mandrake is supposed to be perfect for the less-technically minded, I'd bet there is a significant number of vulnerable machines out there.

My questions are: does anyone have experience with Mandrake 10? Does it behave the same? (note, there was an updated kernel for 9.1, 9.2 and 10.0 yesterday, so it should show up in the updates list if it works). It it is still this broken, I'm not going to stick with Mandrake. Second question: what about other distros? Do they offer kernel updates via their usual update mechanisms (apt, Yum)?

[blakmonk]

Hi,

Here are a few suggestions that will help you enjoy more of your mandrake experience:

- Take a trip to EasyURPMI [easyurpmi.zarb.org...]
choose your update,main,contrib and plf source
- One in a while do "urpmi.update -a" to update your sources
- Once in a while do urpmi --auto-select to update everything that needs it.
- If you wanna help the Mdk Community you can get a MandrakeClub membership, but you are in NO WAY obligated.

For kernel updates, you don't need to know the exact number, you can just :

urpmi kernel

The kernel update you are talking about is not out yet, they need to be tested before, then uploaded to the mirrors. Give it a few days.

BlakMonk

[encyclo]

Thanks for the reply blakmonk. I've got my mirrors and PLF sources set up already, and when I received the mailing-list notification yesterday, I did a

urpmi.update -a

and the new kernel was already available on the update mirror.

You don't quite answer my question though: from what I see, kernel updates do not show up during a normal search for updates via the Mandrake Update interface, or via the auto-select via the command line. I didn't know that you could type

urpmi kernel

rather than specify the version number, as Mandrake's own documents don't specify this for kernel updates. The problem remains - there is no notification of available kernel updates, and no way of installing them without specifying it directly. If you don't read the mailing lists, you wouldn't know to do it. That is where the point of failure lies.

[blakmonk]

Yes,
I a way you are right, but... A kernel update is "THE" only reason to reboot your linuxbox, and one of the very few reason that your machine may not reboot correctly after update. I would say that is why it's not in the auto-select.

I manage several machines, and well, kernel updates is not something I wanna do "automatically", specialy if you have some special hardware or some special patches added to the code.

BlakMonk