Without using the Yum cache, can I retrieve or reconstruct an RPM after it has been installed?

Question

My company manages some RHEL 7 systems for various customers. One customer in particular has a package installed from a non-default repository on their system. Several weeks ago, that repository suddenly and unexpectedly went offline. Now the customer wants a new system spun up with that same package installed. However, we can't obtain a copy of that package - the upstream repo is offline, and we clear out /var/cache/yum daily via an automated process (using yum clean) to save disk space on production systems. We're in contact with the vendor to obtain a copy of the package with no luck so far.

Assuming the Yum cache does not contain a copy, is there any way to retrieve or reconstruct an RPM package after it has been installed through Yum?

There are already several questions (1, 2) that address obtaining a copy of an installed package, but all of the answers depend on the Yum cache.

Obviously the best answer in my particular scenario is to tell the customer that there's nothing we can do until the vendor gets their act together, but let's say for the sake of this question that the customer is hypothetically our biggest customer and they'll leave us if we don't get a new system spun up with their software installed, so we must obtain a copy of the package or else our company risks going under. (In reality I'm just curious if there's a way to do this, my livelihood doesn't actually depend on it.)

Answer 1

The slow annoying manual way might run along the lines of

$ rpm -ql openssh-server
...

and build a tarball from those files. However, you may need to exclude some of those files or directories, depending. Also, you'll need to collect the scripts, if any

$ rpm -q --scripts openssh-server
...

and then find or adapt a suitable newhope.spec to use your newhope.tar.gz as the source, insert the scripts into that spec file, and then some unknown amount of fiddling around and testing and rpmbuilding to get the %files and scripts from above all suitably situated, resolve any conflicts the above dumb make-a-tarball method can create with other packages, etc.

(also rpm -q --conflicts and --requires and --triggers and --provides may need inspection and possible manual inclusion in the spec; basically man rpm and run through every flag mentioned in the query-options flag section to see what that installed RPM contains...)

Answer 2

An answerer to an old question over at SuperUser suggests using rpm --rebuild. However, the version of RPM that comes with RHEL 7 doesn't seem to support this option.

Another approach is to use rpmrebuild, which is available through EPEL on RHEL 7. I was able to use this tool to recreate installed packages. The resulting packages will be almost but not quite identical to the originals. Notably:

• Any changes to the files on disk will be picked up by the new package (most likely to occur for configuration files)
• The package will be unsigned, even if the original package was signed, since no one but the original package signers have a copy of the private key used to sign the package