Creating The Base OS Repository

createrepois a bourne shell script which in turn just calls the underlying python program called /usr/share/createrepo/genpkgmetadata.py. To create a yum repository of all the packages from base operating systems we need to execute the createrepo command in the directory which we want to be turned into a repository as follows:

$ createrepo /var/www/html/yum/CentOS/5/i386/os/

The createrepo command will create all the required headers in the repodata directory. Normally we won't add any new RPM file in the base distribution, so we won't need to generate these headers again. But if for some reason we copy a new RPM file in the base repository or replace an existing RPM file for various reasons, then we need to regenerate the headers with createrepo command.

Configuring a client to use this base repository

On the client machine, remove the information for existing standard distribution repositories. The various configuration for repositories will be present either in etc/yum.conf file or /etc/yum.repos.d directory. If its the later, remove all the files from the /etc/yum.repos.d directory and if its the former, delete all lines defining the default distribution repositories.

The IP address for my local yum server is 192.168.23.43.

The following is an example of CentOS yum client, change it appropriately for a Fedora Core or RHEL yum client. Usually the repositories can be mixed also, but that may in some cases lead to dependency problems.

$ sudo rm -f /etc/yum.repos.d/*
$ sudo vi /etc/yum.repos.d/centos-base.repo 
[base]
name=CentOS-$releasever - Base
baseurl=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/
gpgcheck=1
gpgkey=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/RPM-GPG-KEY-CentOS-5

#released updates 
#[updates]
#name=CentOS-$releasever - Updates
#baseurl=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/updates/
#gpgcheck=1
#gpgkey=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/RPM-GPG-KEY-CentOS-5

Don't bother about the second section containing the updates repository, we have not configured it yet and will be doing it shortly. This is the reason why the second repository has been commented out.

Now to start using this new base repository, do the following:

$ sudo yum clean all
$ sudo yum update

Now any package in the repository can be installed using ''yum install'' and so on.

Setting up Updates and Extras Repository

After the base repository has been setup, it can only be used for installing new packages, but what about the security fixes/patches released by the distribution providers for existing packages? We need an updates repository for applying such packages. There is no hard and fast rule that we need to have an updates repository. So, if you prefer to have only one repository containing an updated/patched version of RPM packages then you can do that as well. All you need to do is replace the concerned RPM file in the base repository with an patched/updated RPM file and then re-run the createrepocommand to re-generate the headers. After that a yum update on the client side will update the concerned RPM.

However, its always advisable to keep the updated packages in a seperate repository for better management and not to touch the base repository after setup. This is the standard approach and this is what we are going to do next.

To start with we need a source from where we can get the updated packages. Choosing one of the mirrors of the distribution in question and continuously syncing the updates from it is a good idea.

I synchronise with my chosen mirrors for CentOS and Fedora Core as follows:

$ rsync rsync://mirrors.kernel.org/centos/5/updates/i386/RPMS/*.rpm /var/www/html/yum/CentOS/5/i386/updates/
$ rsync rsync://mirrors.kernel.org/centos/5/addons/i386/RPMS/*.rpm /var/www/html/yum/CentOS/5/i386/extras/
$ rsync rsync://mirrors.kernel.org/centos/5/centosplus/i386/RPMS/*.rpm /var/www/html/yum/CentOS/5/i386/extras/
$ rsync rsync://mirrors.kernel.org/centos/5/extras/i386/RPMS/*.rpm /var/www/html/yum/CentOS/5/i386/extras/
$ rsync rsync://mirrors.kernel.org/centos/5/fasttrack/i386/RPMS/*.rpm /var/www/html/yum/CentOS/5/i386/extras/

This rsync job can be run as a periodic cron job. The frequency depends on how critical updates are for you. Usually once a day is good enough. After initial sync we can convert this collection of RPMs into a repository by using createrepo utility.

$ createrepo /var/www/html/yum/CentOS/5/i386/updates/
$ createrepo /var/www/html/yum/CentOS/5/i386/extras/

Now we have the updates repository ready, so we can uncomment the commented out section in /etc/yum.repos.d/centos-base.repo file so that it now looks as follows:

$ sudo vi /etc/yum.repos.d/centos-base.repo
[base]
name=CentOS-$releasever - Base
baseurl=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/
gpgcheck=1
gpgkey=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/RPM-GPG-KEY-CentOS-5

# released updates
[updates]
name=CentOS-$releasever - Updates
baseurl=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/updates/
gpgcheck=1
gpgkey=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/RPM-GPG-KEY-CentOS-5

# Other CentOS repositories
[extras]
name=CentOS-$releasever - Extras
baseurl=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/extras/
gpgcheck=1
gpgkey=http://192.168.23.43/yum/CentOS/$releasever/$ARCH/os/RPM-GPG-KEY-CentOS-5

In some cases we have found that the company firewall is blocking all outgoing connections and the only available connections are http and that too using a proxy server. In such cases, we have found that a program called lftp is extremely helpful. RPM packages of lftp are available from here Dag Wieers repository. After installing this we can create a cron job from the following quick script:

$ vi ~/bin/lftp_centos_repo_sync.sh
#!/bin/sh
export http_proxy=http://localproxy.local:8080
export HTTP_PROXY=$http_proxy
cd /var/www/html/yum/CentOS/5/i386/updates
lftp -c mget "http://mirrors.kernel.org/centos/5/updates/i386/RPMS/*.rpm"
createrepo /var/www/html/yum/CentOS/5/i386/updates
cd /var/www/html/yum/CentOS/5/i386/extras
lftp -c mget "http://mirrors.kernel.org/centos/5/fasttrack/i386/RPMS/*.rpm"
lftp -c mget "http://mirrors.kernel.org/centos/5/addons/i386/RPMS/*.rpm"
lftp -c mget "http://mirrors.kernel.org/centos/5/centosplus/i386/RPMS/*.rpm"
lftp -c mget "http://mirrors.kernel.org/centos/5/extras/i386/RPMS/*.rpm"
createrepo /var/www/html/yum/CentOS/5/i386/extras
$ chmod +x ~/bin/lftp_centos_repo_sync.sh

Restricting a repository for a particular set of packages

Sometimes it is desirable to add a repository in local yum configuration, but restrict it to a certain number of packages only. This can be done by adding includepkgs line in the repository config as follows:

$ cat /etc/yum.repos.d/dag-wieers.repo
[dag]
name=Dag-CentOS-$releasever
baseurl=http://192.168.23.43/yum/RHEL/$releasever/$ARCH/dag/
gpgcheck=1
gpgkey=http://192.168.23.43/yum/RHEL/$releasever/$ARCH/dag/RPM-GPG-KEY.dag.txt
includepkgs=clamav clamav-devel clamav-db unrar

This will make sure that only listed packages are downloaded/updated from the local dag repository.