2

I would like to distribute my commercial application using yum (for ease of use and ease of update) on redhat/fedora/centos systems.

The user still has to purchase an account to use the application (via a username/pass login system), but the application itself is free to download - though it is distributed in binary, closed-source form.

Is yum the right choice for this? and if so - is it best to setup a remote repository on my servers to host the yum package? I can't find much information online how to setup a private remote yum repository. If this is the approach i should use, does anyone have any resources on doing this?

Thanks

0

1 Answer 1

4
  1. Create your (binary) RPM packages and don't forget to sign them with your GPG key.

  2. Create the yum repository layout and meta data files with for example the createrepo command/tool.
    Recommended: sign the repository after it has been created by running:

    gpg --detach-sign --armor repodata/repomd.xml 
    

    This will create a repomd.xml.asc file in the repodata directory which for modern versions of yum this will allow yum to verify that the repository metadata came from the owner of the gpg key.

  3. Publish the resulting repo directory layout on a suitable sub domain of yours e.g. https://repo.example.com/yum/.....
    Consider a more complex directory layout with multiple repo's when you create different binary RPM packages for different distro's , major versions, CPU architectures etc.

  4. Publish your ASCII armored public GPG key on a suitable location, for example on https://repo.example.com/publickeys/example-appp-rpm-signing-key.asc

  5. In you App's installation instructions instruct people to add the repository file /etc/yum.repos.d/example-app.repo:

    [example-app]
    name=Example App
    baseurl=https://repo.example.com/yum/.....
    gpgcheck=1
    enabled=1
    gpgkey=https://repo.example.com/publickeys/example-appp-rpm-signing-key.asc
    
  6. Add your public signing key to the RPM keyring [sudo] rpm --import ttps://repo.example.com/publickeys/example-appp-rpm-signing-key.asc


Alternatively ; provide RPM packages that combine steps 5 & 6 ; similar to how for example EPEL distributes release packages: https://docs.fedoraproject.org/en-US/epel/

1
  • thanks! Just curious...i can't host it on the default repo for yum or apt right? cos they're proprietary closed-source apps?
    – horseyguy
    Commented Apr 16, 2023 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .