RPM

Relic generates an RPM repository's repodata from its packages, with repomd.xml signed by the repository's key pair.

Upload a package to any folder of a local repository:

relic artifact upload hello-1.0-1.x86_64.rpm rpm-local/el9/hello-1.0-1.x86_64.rpm

As root, this command writes /etc/yum.repos.d/relic-rpm-virtual.repo with your token. Its gpgkey is the repository's repodata/repomd.xml.key, so dnf reads the public keys from Relic:

relic package setup dnf rpm-virtual --write

For a repository with a metadataDepth, --folder names the folder whose repodata dnf uses, such as --folder el9. For a remote, the file checks no signature: the upstream signs its repodata and packages, so add the upstream's gpgkey to check them.

Install through Relic:

dnf install hello

To configure dnf by hand, add /etc/yum.repos.d/relic.repo:

[relic]
name=Relic
baseurl=https://relic.example.com/rpm/rpm-virtual
username=<you>
password=<token>
gpgcheck=0
repo_gpgcheck=1
gpgkey=https://relic.example.com/rpm/rpm-virtual/repodata/repomd.xml.key

metadataDepth (Metadata depth) and signingKey (Signing key) are repository settings:

apiVersion: relic.build/v1
kind: Repository
metadata:
  name: rpm-local
spec:
  class: local
  format: rpm
  metadataDepth: 1
  signingKey: rpm-signing

• repo_gpgcheck=1 checks repomd.xml.asc, Relic's signature. dnf downloads gpgkey with the repository's username and password. When repomd.xml.asc is signed by a key dnf has not imported, dnf downloads gpgkey again, imports the keys it does not have and checks again, asking first unless it runs with -y. gpgcheck checks the packages' own signatures; enable it for signed packages, with their vendor's key.
• signingKey names an OpenPGP key pair, created on first use; key pairs cannot be imported. The default is relic-gpg. secondarySigningKey names a second key pair whose public key repomd.xml.key also holds, so the key can be replaced without running setup again on clients whose gpgkey is that URL (Signing keys). relic api key-pairs lists them.
• metadataDepth 0 (default) indexes the whole repository at repodata/; 1 indexes each top folder (el9/repodata/, el10/repodata/), so one repository serves several releases.
• A remote proxies an upstream repository, such as https://dl.rockylinux.org/pub/rocky/9/BaseOS/x86_64/os. A virtual repository merges its members' repodata, remote ones included, and signs the result.
• A virtual repository serves repodata at its own metadataDepth, from the same folder of each member: with metadataDepth: 1, el9/repodata/ lists its members' el9/ packages. With 0, it lists all of its members' packages.
• A virtual repository's repodata is rebuilt at most every 30 seconds. A request after that gets the last built copy while one rebuild runs, and waits for the rebuild when the copy is older than 10 minutes.
• Through the JFrog® Artifactory® API, package type yum is an RPM repository, yumRootDepth is the metadata depth, primaryKeyPairRef the signing key and secondaryKeyPairRef the secondary signing key.