We have a fairly strict patching process that we have to follow:
- Patch a development or testing machine
- Wait one week to see if it explodes
- Patch the corresponding production machine to the same package versions
I can't seem to accomplish this with yum, as it insists on updating the packages to the latest version on the production servers. Has anyone else developed a workflow/procedure to accomplish this?
- Mirroring packages locally and controlling when the mirrors are updated. But, since some systems are tied to license numbers (Oracle Linux in this case), I don't think I can mirror those repos.
- Disabling the yum-updatesd daemon and running yum check-update on both the production machine and testing at the same time. But, later when I run yum update -C to try and update from cache, it fails (Something with EPEL).