Though note that redhat is doing this with all GPL software, but without a CLA.

They retaliate against customers that share source code, and claim that this doesn’t fall under the “without further restrictions” clause in the redistribution of source code phrase in the GPL.

Anyway, rug pulls are apparently possible, even with the GPL, at least until this is taken to court and IBM loses.

How does Rocky Linux continue to get timely updates from upstream?

Do they have to use shells or other subterfuge?

It looks like they’re not RHEL compatible any more:

https://www.zdnet.com/article/rocky-linux-9-arrives-with-eve...

That says they pull from CentOS Stream, which I think is upstream from RHEL.

According to this other article [0] they still aim for 1:1 compatibility with RHEL, and not Stream. I also don't see any mention of Stream in the Rocky 9 release notes.

[0] https://linuxiac.com/rocky-linux-confirmed-to-remain-fully-c...

Neither you nor the parent comment are using rug pull in the sense of the article.

That depends on what's written on the CLA.

In case of dual license, this is the stated goal so there is no "pull". (Unless they stop with the GPL version, but I'd say this is unlikely)