How do i distribute my commercial application using the yum package manager?

Question

I would like to distribute my commercial application using yum (for ease of use and ease of update) on redhat/fedora/centos systems.

The user still has to purchase an account to use the application (via a username/pass login system), but the application itself is free to download - though it is distributed in binary, closed-source form.

Is yum the right choice for this? and if so - is it best to setup a remote repository on my servers to host the yum package? I can't find much information online how to setup a private remote yum repository. If this is the approach i should use, does anyone have any resources on doing this?

Thanks

Answer 1

1. Create your (binary) RPM packages and don't forget to sign them with your GPG key.

2. Create the yum repository layout and meta data files with for example the createrepo command/tool.
   Recommended: sign the repository after it has been created by running:

   gpg --detach-sign --armor repodata/repomd.xml 
   

   This will create a repomd.xml.asc file in the repodata directory which for modern versions of yum this will allow yum to verify that the repository metadata came from the owner of the gpg key.

3. Publish the resulting repo directory layout on a suitable sub domain of yours e.g. https://repo.example.com/yum/.....
   Consider a more complex directory layout with multiple repo's when you create different binary RPM packages for different distro's , major versions, CPU architectures etc.

4. Publish your ASCII armored public GPG key on a suitable location, for example on https://repo.example.com/publickeys/example-appp-rpm-signing-key.asc

5. In you App's installation instructions instruct people to add the repository file /etc/yum.repos.d/example-app.repo:

   [example-app]
   name=Example App
   baseurl=https://repo.example.com/yum/.....
   gpgcheck=1
   enabled=1
   gpgkey=https://repo.example.com/publickeys/example-appp-rpm-signing-key.asc
   

6. Add your public signing key to the RPM keyring [sudo] rpm --import ttps://repo.example.com/publickeys/example-appp-rpm-signing-key.asc

---

Alternatively ; provide RPM packages that combine steps 5 & 6 ; similar to how for example EPEL distributes release packages: https://docs.fedoraproject.org/en-US/epel/