aws-patch v1.10.5

Added

• Full AL2023 point-release list logged on every run. Previously
  only the single highest pending release was logged
  (Newer Amazon Linux release available: X). Now every pending point
  release is listed with its exact dnf upgrade --releasever=...
  command, and the run explicitly states whether the kernel will be
  included or excluded when crossing -- visible in --check,
  --dry-run, and live runs alike, not just the interactive picker.

Fixed

• --kernel didn't govern the AL2023 release-crossing step. Crossing
  a point-release boundary applies that release's full package set,
  which very often bundles a kernel bump alongside everything else.
  pm_upgrade_releasever always applied it unconditionally regardless of
  --kernel -- meaning a plain --yes run (no --kernel) could still
  silently end up installing a new kernel, just because a release
  boundary happened to be pending, completely defeating --kernel's
  opt-in guarantee for that specific path.
  • lib/dnf.sh: new pm_upgrade_releasever_no_kernel(), mirroring
    pm_full_upgrade_no_kernel() -- runs the release-crossing
    transaction with native --exclude='kernel*'.
  • aws-patch.sh: run_patch() now selects the correct
    releasever-upgrade function based on FLAG_KERNEL, exactly like it
    already does for the normal full-upgrade step. Dry-run messaging
    updated to match.
• New test coverage confirming pm_upgrade_releasever_no_kernel excludes
  the kernel and pm_upgrade_releasever (the --kernel path) does not.
  81/81 tests passing.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.5/aws-patch_1.10.5_all.deb
sudo dpkg -i aws-patch_1.10.5_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.5/aws-patch-1.10.5-1.noarch.rpm
sudo rpm -i aws-patch-1.10.5-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.10.3

Added

• GRUB default boot entry mismatch detection (RHEL-family, where
  grubby is available). A kernel can be genuinely, correctly
  installed -- real boot files present, not a stale database entry --
  and still not be what a reboot would actually load, if GRUB's own
  default boot entry was never updated to point at it (normally
  automatic via the kernel package's own post-install scriptlets, but
  can fail to complete after an interrupted transaction). Previously
  aws-patch had no way to detect this before rebooting; a --reboot
  run would silently restart into the exact same kernel that was already
  running, with nothing in the summary to reveal why.
  • lib/kernel.sh: new _kernel_grub_default_matches() -- read-only
    (grubby --default-kernel) comparison against the kernel version a
    reboot is expected to load. Sets KERNEL_BOOT_DEFAULT_MISMATCH.
    Unverifiable systems (no grubby -- most Debian/Ubuntu installs)
    are left unflagged rather than guessed at by parsing grub.cfg,
    which would risk false positives blocking legitimate reboots.
  • lib/summary.sh: reports Reboot Required: GRUB DEFAULT MISMATCH
    distinctly from both a plain YES and a STALE ENTRY.
  • aws-patch.sh: handle_reboot() skips the no-op reboot (even with
    --reboot/--yes) and logs the exact grubby --set-default
    command needed, instead of rebooting into nothing changing.
  • docs/troubleshooting.md: new "GRUB default not updated to the new
    kernel" section with the full fix.
  • This is read-only inspection only -- lib/kernel.sh still never
    writes to GRUB or changes the default boot entry itself; the file's
    header comment was clarified to make that distinction explicit.
• New test coverage in tests/run_tests.sh (== GRUB default boot entry mismatch ==): mismatch detected, correct-default not falsely
  flagged, and grubby-unavailable never blocks a reboot.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.3/aws-patch_1.10.3_all.deb
sudo dpkg -i aws-patch_1.10.3_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.3/aws-patch-1.10.3-1.noarch.rpm
sudo rpm -i aws-patch-1.10.3-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.10.1

Fixed

• Amazon Linux 2023 "newer release available" reported forever, even
  immediately after successfully upgrading to that exact release.
  dnf's release-notification banner lists the latest known AL2023
  point-release snapshot unconditionally -- including when it's the
  exact one the host is already running. pm_check_releasever_update
  (lib/dnf.sh) was reporting that scraped value as "available" with no
  comparison against the currently running release, so every run
  re-triggered the expensive pm_upgrade_releasever step
  (dnf upgrade --releasever=..., often 30s-plus, sometimes much longer
  under load) for a release the host was already on -- with nothing to
  actually upgrade. Fixed by extracting the currently-running dated
  snapshot from OS_NAME/PRETTY_NAME (the generic OS_VERSION_ID is
  only ever "2023" and can't be used for this comparison) and only
  reporting a candidate that is genuinely newer. pm_list_releasever_updates
  received the same fix. New regression tests reproduce the exact
  scenario from a live host (banner lists 2023.12.20260727while
  already running 2023.12.20260727) alongside a "genuinely behind"
  case to confirm real updates are still detected correctly.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.1/aws-patch_1.10.1_all.deb
sudo dpkg -i aws-patch_1.10.1_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.1/aws-patch-1.10.1-1.noarch.rpm
sudo rpm -i aws-patch-1.10.1-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.10.0

Added

• --kernel flag. By default, aws-patch now excludes the kernel
  package from a run's upgrade entirely: every other package still
  patches normally, but the kernel is left exactly as it was, so routine
  patching never forces a reboot decision. Pass --kernel to also
  install a newer kernel if one's available (pairs naturally with
  --reboot: sudo aws-patch --yes --kernel --reboot).
  • lib/apt.sh: new pm_full_upgrade_no_kernel() — holds the
    currently-installed linux-image-*/linux-headers-*/
    linux-modules-* packages via apt-mark hold for the duration of
    the upgrade and always unholds them after, success or failure.
  • lib/yum.sh / lib/dnf.sh: new pm_full_upgrade_no_kernel() —
    runs the upgrade transaction with native --exclude='kernel*'.
  • aws-patch.sh: run_patch() now branches on --kernel; when
    excluded, a clear summary line and warning report that a kernel
    update was available but skipped, and how to include it next run.
  • lib/summary.sh: new Kernel Update: field, and the final warning
    now distinguishes "will install" from "excluded this run (pass
    --kernel to include)".
  • This never changes what happens to a kernel that's already
    installed -- no package is ever removed and GRUB is never touched,
    same guarantees as always.
• New test coverage in tests/run_tests.sh for --kernel flag parsing/
  help documentation and pm_full_upgrade_no_kernel behavior on all
  three package managers (== pm_full_upgrade_no_kernel (--kernel gating) ==).

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.0/aws-patch_1.10.0_all.deb
sudo dpkg -i aws-patch_1.10.0_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.10.0/aws-patch-1.10.0-1.noarch.rpm
sudo rpm -i aws-patch-1.10.0-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.9.0

Added

• utils_filter_valid_kernel_lines in lib/utils.sh: a shared filter
  that every pm module now runs candidate kernel package lines through
  before picking a "latest" version with sort -V. This closes a gap
  where a package that merely looks like a kernel version string could
  win that comparison and be misreported as an installed or available
  kernel:
  • lib/apt.sh (pm_get_installed_kernels,
    pm_get_latest_available_kernel): now excludes -dbgsym, -dbg,
    and -unsigned packages (e.g. linux-image-6.8.0-31-generic-dbgsym
    ships no bootable kernel at all, but its name sorts as a valid, and
    sometimes higher, version).
  • lib/yum.sh and lib/dnf.sh (pm_get_latest_available_kernel):
    candidates are now anchored to the detected $ARCH, excluding
    kernel.src (source RPM, not installable) and any other
    architecture's build that a multilib-capable yum/dnf
    configuration might otherwise surface.
• New test coverage in tests/run_tests.sh for all of the above
  (== invalid kernel candidate filtering ==).

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.9.0/aws-patch_1.9.0_all.deb
sudo dpkg -i aws-patch_1.9.0_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.9.0/aws-patch-1.9.0-1.noarch.rpm
sudo rpm -i aws-patch-1.9.0-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.8.1

Fixed

• release.yml's "Create GitHub Release" step failed with a release with the same tag name already exists on any re-run where the
  release had already been created in a prior attempt (e.g. the pages
  job failing on GitHub's auto-created github-pages environment
  protection rules, which rejects tag refs by default -- a separate,
  one-time Settings fix -- while the independent release job, which
  only depends on build, had already succeeded and created the
  release). Made the step idempotent: it now checks whether a release
  for the tag already exists via gh release view and deletes it
  first (keeping the underlying git tag intact) before recreating it,
  so re-running the workflow always produces a clean, current release
  instead of failing on a duplicate.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.8.1/aws-patch_1.8.1_all.deb
sudo dpkg -i aws-patch_1.8.1_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.8.1/aws-patch-1.8.1-1.noarch.rpm
sudo rpm -i aws-patch-1.8.1-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.8.0

Added

• Automated GitHub Pages deployment via a new reusable workflow,
  .github/workflows/pages.yml, using the official Actions-based flow
  (actions/configure-pages → actions/upload-pages-artifact →
  actions/deploy-pages) instead of the manual "Deploy from a branch"
  setting. Runs two ways:
  • Standalone, on every push to main that touches docs/** — the
    site updates the moment index.html/styling/copy changes, with no
    need to cut a release.
  • As a job inside .github/workflows/release.yml (invoked via
    uses: ./.github/workflows/pages.yml), running in parallel with
    the package build once the lint/test gate passes -- so a single
    git push origin vX.Y.Z now handles tests, .deb/.rpm packages,
    the GitHub Release, and the Pages deploy together, as one
    pipeline.
• README: rewrote the "Project site (GitHub Pages)" section to describe
  the automated flow (including the one-time "Settings → Pages → Source:
  GitHub Actions" switch, since the branch-based and Actions-based
  deployment mechanisms don't share state) in place of the old manual
  branch/folder setup steps.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.8.0/aws-patch_1.8.0_all.deb
sudo dpkg -i aws-patch_1.8.0_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.8.0/aws-patch-1.8.0-1.noarch.rpm
sudo rpm -i aws-patch-1.8.0-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.7.0

Added

• Project landing page at docs/index.html, served via GitHub Pages at
  https://yousafkhamza.github.io/aws-patch/ once enabled (Settings →
  Pages → Deploy from a branch → main / /docs — see README for full
  steps). Fetches the latest release directly from the GitHub API
  (GET /repos/yousafkhamza/aws-patch/releases/latest) client-side on
  load, so the version number, publish date, and download links for
  every release asset (.deb, .rpm, tarball, SHA256SUMS) always
  reflect whatever was most recently published -- nothing to update by
  hand when a new version ships. Also renders exact dpkg/rpm install
  commands with the real asset filenames filled in once the API response
  arrives. Falls back to a direct link to the Releases page if the API
  call fails (e.g. hourly rate limit from an unauthenticated client)
  rather than showing a broken UI. Dark terminal-styled design (amber/
  green accents on near-black) matching the project's own console
  output aesthetic; includes an "Open Source" / "MIT License" badge
  pair and an author credit.
• docs/.nojekyll so GitHub Pages serves docs/ as-is (needed since
  the directory also holds plain Markdown troubleshooting/recovery docs
  and the man page source, none of which are meant to be Jekyll-built).
• README: "Project site (GitHub Pages)" section with one-time setup
  steps, and a site badge/link at the top of the README.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.7.0/aws-patch_1.7.0_all.deb
sudo dpkg -i aws-patch_1.7.0_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.7.0/aws-patch-1.7.0-1.noarch.rpm
sudo rpm -i aws-patch-1.7.0-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.

aws-patch v1.6.1

Fixed

• .github/workflows/release.yml's "Run test suite" and "Build .deb and
  .rpm packages" steps invoked ./tests/run_tests.sh and
  ./scripts/build-packages.sh directly, which depend on the
  executable bit surviving into the GitHub Actions checkout. On the
  first real run this failed with Permission denied (exit 126) --
  the bit hadn't survived however the repository's history was
  populated. Fixed by invoking both via explicit bash <script> instead
  of direct execution, which only requires the file to be readable, plus
  an added chmod +x step as defense in depth. Also hardened
  tests/run_tests.sh itself: it previously invoked aws-patch.sh
  directly in several places ("${REPO_ROOT}/aws-patch.sh" --version,
  etc.), which would hit the identical failure mode in any checkout
  missing the bit; switched to bash "${REPO_ROOT}/aws-patch.sh"
  throughout. Verified by stripping every executable bit in the repo
  and confirming bash tests/run_tests.sh still passes all 51 tests.

---

Install

Debian/Ubuntu:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.6.1/aws-patch_1.6.1_all.deb
sudo dpkg -i aws-patch_1.6.1_all.deb

RHEL/Amazon Linux/Rocky/AlmaLinux:

curl -fsSLO https://github.com/yousafkhamza/aws-patch/releases/download/v1.6.1/aws-patch-1.6.1-1.noarch.rpm
sudo rpm -i aws-patch-1.6.1-1.noarch.rpm

One-line installer (any supported OS):

curl -fsSL https://raw.githubusercontent.com/yousafkhamza/aws-patch/main/install.sh | sudo bash

Verify downloads against SHA256SUMS in this release.