From 8a22d04ff9900ba1dde1bffd8c022e10b972170e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Thu, 6 Aug 2026 23:26:42 -0300
Subject: [PATCH] fix(otherpkgs): restrict the package upgrade to the xCAT
 repositories

The otherpkgs postscript ran a bare "yum -y upgrade" after configuring the
xcat-otherpkgs* repositories. That upgrades every installed package from every
enabled repository, so installing a handful of extra packages could also pull
an unrelated distribution update onto the node, at provision time and without
the administrator asking for it.

Scope the upgrade to the repositories the postscript just wrote, which is what
the surrounding code already implies it does. The package install path is left
untouched, so dependencies still resolve against the full repository set.

Only the yum/dnf branch is changed. The zypper and apt branches have the same
unbounded behavior but no equivalent one-flag fix, so they are left alone
rather than half-converted.

Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
---
 xCAT/postscripts/otherpkgs | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/xCAT/postscripts/otherpkgs b/xCAT/postscripts/otherpkgs
index 05a6c4806..515278b91 100755
--- a/xCAT/postscripts/otherpkgs
+++ b/xCAT/postscripts/otherpkgs
@@ -877,12 +877,14 @@ EOF`
         op_index=$((op_index+1))
         continue
     fi
-    #now update all the existing rpms
+    #now update the existing rpms that the otherpkgs repositories provide.
+    #Restrict the upgrade to the xcat-otherpkgs* repositories written above, so
+    #that running otherpkgs does not also apply unrelated distribution updates.
     if [ $hasyum -eq 1 ]; then
         if [ $VERBOSE  ]; then
-          echo "$envlist $yumcmd -y upgrade"
+          echo "$envlist $yumcmd -y --disablerepo=* --enablerepo=xcat-otherpkgs* upgrade"
         fi
-        result=`eval $envlist $yumcmd -y upgrade 2>&1`
+        result=`eval $envlist $yumcmd -y --disablerepo=* --enablerepo=xcat-otherpkgs* upgrade 2>&1`
         R=$?
         if [ $R -ne 0 ]; then
               RETURNVAL=$R