Repositories, BaseOS, AppStream and module streams

Where packages come from

dnf does not invent packages; it downloads them from repositories (repos). A repo is a folder on a web server, an FTP server or a local disk, holding .rpm files and metadata: an index of what is there. dnf reads the metadata to know what can be installed. On a registered RHEL system the Red Hat repos are set up for you by subscription-manager; on Rocky or Alma they come preconfigured.

$ dnf repolist
repo id                                   repo name
rhel-9-for-x86_64-appstream-rpms          Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
rhel-9-for-x86_64-baseos-rpms             Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
$ dnf repolist all          # also disabled repos

Writing a .repo file

A .repo file is a small text file in INI format: a [section] with an ID, then key=value lines. Every file in /etc/yum.repos.d/ ending in .repo is read.

# /etc/yum.repos.d/local.repo
[local-baseos]
name=Local BaseOS
baseurl=http://repo.example.com/rhel9/BaseOS
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[local-appstream]
name=Local AppStream
baseurl=http://repo.example.com/rhel9/AppStream
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

• [local-baseos]: the repo ID. Must be unique and have no spaces.
• baseurl: where the repo is: http://, https://, ftp:// or file:// for a local folder.
• enabled=1: use it (0 = ignore).
• gpgcheck=1: check every package's digital signature against gpgkey, so nobody can slip in a fake package. Keep it on.

# dnf config-manager --add-repo http://repo.example.com/rhel9/BaseOS   # writes a .repo file for you
# dnf config-manager --set-disabled local-appstream
# dnf clean all          # forget cached metadata after changing repos
# dnf repolist

A repository from the installation ISO

In a lab without internet or a subscription, the RHEL ISO image contains a full BaseOS and AppStream repo. Mount it and point two repos at it with file:// URLs.

# mkdir -p /mnt/iso
# mount -o ro /dev/sr0 /mnt/iso          # or: mount -o loop rhel-9.4-x86_64-dvd.iso /mnt/iso
# ls /mnt/iso
AppStream  BaseOS  EFI  images  isolinux  ...
# then in a .repo file: baseurl=file:///mnt/iso/BaseOS  and  baseurl=file:///mnt/iso/AppStream

Module streams (RHEL 8 and 9)

Some AppStream software is offered in several versions at once, called module streams. For example, nodejs may have streams 18 and 20. You enable one stream, and dnf installs that version. Only one stream of a module can be enabled at a time. Not everything is a module; most packages are normal. RHEL 10 no longer uses modules, so treat this as a RHEL 8/9 skill.

$ dnf module list nodejs
Name     Stream   Profiles                         Summary
nodejs   18       common [d], development, minimal  Javascript runtime
nodejs   20       common [d], development, minimal  Javascript runtime
Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled
# dnf module enable -y nodejs:20
# dnf module install -y nodejs:20/common
# dnf module reset nodejs        # go back before switching streams

Common mistakes

• A typo in baseurl (http:/ instead of http://, or the wrong folder). dnf repolist then shows errors like "Cannot download repomd.xml". Open the URL in curl to check: curl -I URL/repodata/repomd.xml.
• Setting gpgcheck=0 to "make it work". You lose the protection against tampered packages. Import or point to the right key instead.
• A .repo file without the .repo ending. dnf ignores it.