In order to have a download link in our setup guide that doesn't change, EPEL uses symlinks to the latest version of epel-release for each major version. That symlink is maintained by the new-updates-sync script, which runs every minute on a cron job.

Now that we have multiple EPEL 10 minor versions, we have encountered an intermittent problem. When the script loops over the 10.1 release, it updates that symlink to:

• epel-release-latest-10.noarch.rpm -> 10/Everything/x86_64/Packages/e/epel-release-10-3.el10_0.noarch.rpm

When the script loops over the 10.0 release, it updates that symlink to:

• epel-release-latest-10.noarch.rpm -> 10.0/Everything/x86_64/Packages/e/epel-release-10-3.el10_0.noarch.rpm

When this symlink is changing, there is a short window where the download link will return a 403. This normally isn't a problem because the symlink should only be modified when there is a new release of the package. However, flipping the symlink back and forth like this significantly increases the chances a user will encounter a 403 error. We faced a similar problem in fedora-infrastructure#12326 where we realized the symlink was getting updated for every architecture.

Currently the script won't change the symlink if the absolute destination path is the same. We probably should change that to only check the filename (which will often match between EPEL 10 minor versions), not the full path.

cc: @dherrera