Using RPMs and YUM on IBM i 7.1? If So, Be Warned!
In this Open Your i blog post, IBMer Kevin Adler guest blogs about the end of service for RPM and YUM on IBM i 7.1.
By Jesse Gorzinski08/07/2019
As you probably know, IBM provides an open source repository of RPMs that can be installed and managed using the YUM package manager on IBM i. This repository has been available since May 2018 and officially targets IBM i 7.2 and up. Many of you may have noticed that when you look through the repository, you see many RPMs labeled with ibmi7.1 in the name, eg. bash-4.4-1.ibmi7.1.ppc64.rpm. Heck, even YUM itself is available as an ibmi7.1 rpm: yum-3.4.3-17.ibmi7.1.noarch.rpm. The curiosity may get the better of you and attempt to install these RPMs on an IBM i 7.1 machine and notice that everything works just fine! Well, until you try to install an rpm that has ibmi7.2 in the name—but that’s to be expected, right?
One might ask, “If IBM i 7.1 is not supported, why allow this to work in the first place? Why not just build everything on 7.2?” There are a variety of reasons for this. Firstly, IBM i 7.1 had just entered EOS (end of support) and we knew a lot of clients were still running this older release. By allowing users to replace 5733-OPS and run YUM and RPMs on 7.1, it meant that users would have an easier transition to IBM i 7.2. Additionally, we still need to maintain IBM i 7.1 for extended support and having YUM and RPMs available on IBM i 7.1 made our lives easier. Finally, the most pragmatic answer: If it works, why arbitrarily restrict it?
OpenSSL End of Support
It's far from arbitrary. One impetus for this change is OpenSSL. OpenSSL 1.0.2 is going out of support by the end of 2019 and without the OpenSSL community maintaining this version, we do not have the manpower to ensure that security problems are found and fixed. Therefore, we will have to rebuild all software that uses OpenSSL to build against the supported OpenSSL 1.1.1 instead. Since OpenSSL 1.1.1 has capabilities which require IBM i 7.2 in order to function and YUM has a dependency on OpenSSL in order to access HTTPS repositories, the net effect will mean that YUM will no longer be able to install on IBM i 7.1 systems. Because the package manager has such a vital role in the ecosystem, not having it be available on IBM i 7.1 pushed us to the tough decision to rebuild everything else for IBM i 7.2.
So what's going to happen?
On September 24th, all the existing IBM i 7.1 RPMs will be updated with IBM i 7.2 replacements.
What if I’m still on IBM i 7.1 at that time?
While we urge you to migrate to IBM i 7.2 as soon as possible, we realize that such an endeavor may not be feasible in this timeframe. If you want or need to continue using YUM on IBM i 7.1, it’s advised to create a mirror of the IBM repository before that time. This can be done with the Access Client Solutions (ACS) tool (some documentation here). Just remember that after September 24th, you will not be able to update this mirror and you will no longer get bug fix or security updates.
We hope that you enjoyed having a “yummy” IBM i 7.1 while it lasted, but nothing lasts forever. We didn’t make this decision lightly, but hope you understand why it has to be done. It’s been a great year for open source on IBM i and this move will help us continue to build and deliver great open source for the future.
Jesse Gorzinski is the business architect of open source technologies. More →