Some thoughts about yum and repositories

[D. D. Brierton]

On Thu, 2004-10-28 at 19:51, Michael A. Peters wrote:
> On 10/28/2004 11:14:17 AM, D. D. Brierton wrote:
> > Judging from recent discussions on this list, it seems that many are
> > still confused about configuring their yum.conf files, and about all
> > the
> > different repositories out there.
> 
> With the new /etc/yum.repos.d this will be less of an issue.
> install a noarch rpm that puts the repo in /etc/yum.repos.d

That sounds interesting. Is that functionality proposed or actually
available in the latest yum? Would this noarch repo rpm be automatically
downloaded and installed by yum from some simpler incantation, like "yum
subscribe rpm.livna.org" or do you have to manually go and find it and
install it by hand?

> > I was wondering if there
> > was
> > something that could be done to yum itself (either the client program
> > itself, or the format of yum repositories) to make this easier.
> 
> Well, people could read the instructions.

Yes, I know they could. But sometimes its nice when things "just work".

> But each repo having a simple noarch rpm that installs a single file in  
> repos.d will go a long way.

Yes, that sounds like a big improvement.

> >      2. Yum repositories should be able to announce that they are
> >         dependent on other yum repositories: if I sign up to  
> > Livna.org
> > I
> >         am then automatically signed up to Fedora.us.
> 
> No.
> livna specifically states you need fedora.us - and that's the way it  
> should be. Do not automagically add any repos.

Why not? I know that livna clearly states this dependency, but why can't
yum take care of the dependency for you. Otherwise why bother to use yum
at all? You could just use rpm and take care of the dependencies
yourself.

> >      3. If 1. can be implemented, then I think the GPG key of the
> >         repository should automatically be installed
> 
> No. a gpg key should be installed only by the system administrator.

Surely the system administrator would be the one running yum.

> What should happen is the Fedora base gpg key is installed at install,  
> and by default yum requires gpg key.

But that is so user-unfirendly. How about yum prompting you to install
the gpg key, and when you say yes it automatically installs it for you?

> Then when you add fedora.us and rpm.livna.org - installing packages via  
> yum will fail if you don't have the gpg key. But they should not be  
> auto installed. The info page for the repository should point to where  
> it is at.

I really don't understand why that is more secure then yum prompting you
with something like this:

Install the GPG key for rpm.livna.org from
http://rpm.livna.org/RPM-LIVNA-GPG-KEY? [y/N]

and on typing "y" it fetches it for you and installs it.

> >      4. I shouldn't need to alter my yum.conf when I upgrade to a new
> >         version of FC -- yum should determine which version of FC I  
> > am
> >         running
> 
> It already has that capability. I don't remember if it uses it or not,  
> but yum has ability to get version info from /etc/redhat-release

Yes, that was my mistake. I was confused by some messages on
fedora-test.

> >      5. I should be able to subscribe to a repository from the  
> > command
> >         line without manually editing yum.conf (i.e. something like
> > "yum
> >         subscribe rpm.livna.org").
> 
> I'm not a yum developer - but I am planning to sort of add this to yum  
> (as soon as I feel comfortable with python) by Elektrifying yum - so  
> that yum can use the elektra registry for repositories.

Sounds excellent.

> But anyway - what you describe can already be done with current yum -
> wget location/fc3/repo.conf && mv repo.conf /etc/yum.repos.d/

Except that is rather less discoverable.

> >      6. There should be some way of distinguishing between a
> > repository
> >         that is part of Fedora Core, or Fedora Extras or Fedora
> >         Alternatives. Subscribing to a repository from Fedora
> >         Alternatives should warn the user of potential problems.
> 
> Fedora Core should not show bias towards fedora.us repository.

No, I agree. I was suggesting that users be made aware of the
differences between packages from Fedora Core ("official" packages),
Fedora Extras (additional programs that won't alter Fedora Core), and
Fedora Alternatives (additional programs that might alter either or both
of Fedora Core and Fedora Extras).

> However - I think it would be nice to warn when packages installed by  
> Fedora Core are set to be replaced by non Fedora Core packages.

Exactly my thinking.

> That though would require the vendor tag be used, that's the best way  
> to do that - through rpm and not yum - though yum would have to catch  
> rpm's warning and inform the user.

Hmmm. The trouble is that I want to distinguish between Fedora Extras
and Fedora Alternatives as well, and I don't see how you can do that
with the vendor tag, which is why I was thinking of "channels".

Best, Darren

-- 
=====================================================================
D. D. Brierton            darren at dzr-web.com          www.dzr-web.com
       Trying is the first step towards failure (Homer Simpson)
=====================================================================