An RPM mirror for dnf and yum

A registry's address is the folder that holds repodata/, like https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os. Pick the advisory feed of its distro, and in whitelist mode add an RPM allow rule of *, then deny or kill what you do not want, since a distro has thousands of packages. Clients get a .repo file:

[company-baseos]
name=Company mirror of AlmaLinux 9 BaseOS
baseurl=https://packages.example.com/rpm/almalinux-9-baseos/
username=your-user-name
password=<your token>
gpgcheck=1
repo_gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9

Two ways to hand out the index

By default the signed index goes out untouched, so clients keep repo_gpgcheck=1 and trust stays with the distro. Every package download is checked: the rules, the kill switch, holds, advisories and cooling off, then the package is checked against the checksum in the index, kept and scanned. The catch is that dnf still sees every version, so it can pick one that is then refused.

Filtered index hands out an index of only what the rules and the kill switch allow, so dnf never picks a refused version. The distro did not sign that index, so clients must set repo_gpgcheck=0. Package signatures are still checked with gpgcheck=1.

Either way, only the repodata and the packages its index lists are served, and every metadata file is checked against the checksum in repomd.xml.

What applies, and what does not

Rules, the kill switch, quarantine, cooling off (the index gives a publish time for each package), malware scanning (the OSV known malicious check included), license policy from the package header, requests and auto approve all apply. Advisories come from OSV, in the feed you pick for each mirror: AlmaLinux 8, 9 or 10, Rocky Linux 8, 9 or 10, or Red Hat.

Honest limits: rules take exact package names, with exact versions or comparators like >=3.0.7. Nothing is published here. Typosquat checks, provenance checks and the tree walk are not offered for RPM.