Chapter 3. Configuring RHEL image builder repositories

Procedure

1. Create a repository source file, such as /root/repo.toml. For example:

   id = "k8s"
   name = "Kubernetes"
   type = "yum-baseurl"
   url = "https://server.example.com/repos/company_internal_packages/"
   check_gpg = false
   check_ssl = false
   system = false

   The type field accepts the following valid values: yum-baseurl, yum-mirrorlist, and yum-metalink.

2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

2. Check the new source content:

   $ composer-cli sources info <source_id>

Procedure

1. Create a repository source file, such as /root/repo.toml. For example, to specify the distribution:

   check_gpg = true
   check_ssl = true
   distros = ["rhel-8"]
   id = "rh9-local"
   name = "packages for RHEL"
   system = false
   type = "yum-baseurl"
   url = "https://local/repos/rhel8/projectrepo/"

2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

2. Check the new source content:

   $ composer-cli sources info <source_id>

Procedure

1. Access the folder where you want to create a repository:

   $ cd repo/

2. Run the createrepo_c to create a repository from RPM packages:

   $ createrepo_c .

3. Access the directory where the repodata is:

   $ cd repodata/

4. Sign your repomd.xml file:

   $ gpg -u <_gpg-key-email_> --yes --detach-sign --armor /srv/repo/example/repomd.xml

5. To enable GPG signature checks in the repository:

   1. Set check_repogpg = true in the repository source.

   2. Enter the gpgkey that you want to do the check. If your key is available over https, set the gpgkeys field with the key URL for the key. You can add as many URL keys as you need.

      The following is an example:

      check_gpg = true
      check_ssl = true
      id = "signed local packages"
      name = "repository_name"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      check_repogpg = true
      gpgkeys=["https://local/keys/repokey.pub"]

      As an alternative, add the GPG key directly in the gpgkeys field, for example:

      check_gpg = true
      check_ssl = true
      check_repogpg
      id = "custom-local"
      name = "signed local packages"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      gpgkeys=["https://remote/keys/other-repokey.pub",
      '''-----BEGIN PGP PUBLIC KEY BLOCK-----
      …​
      -----END PGP PUBLIC KEY BLOCK-----''']

      • If the test does not find the signature, the GPG tool shows an error similar to the following one:

        $ GPG verification is enabled, but GPG signature is not available.
        This may be an error or the repository does not support GPG verification:
        Status code: 404 for http://repo-server/rhel/repodata/repomd.xml.asc (IP: 192.168.1.3)

      • If the signature is invalid, the GPG tool shows an error similar to the following one:

        repomd.xml GPG signature verification error: Bad GPG signature

Procedure

1. Create the /etc/osbuild-composer/repositories/ directory to store your repository overrides:

   $ sudo mkdir -p /etc/osbuild-composer/repositories

2. Create a JSON file, using a name corresponding to your RHEL version. Alternatively, you can copy the file for your distribution from /usr/share/osbuild-composer/ and modify its content.

   For RHEL 8.9, use /etc/osbuild-composer/repositories/rhel-89.json.

3. Add the following structure to your JSON file. Specify only one of the following attributes, in the string format:

   • baseurl - The base URL of the repository.
   • metalink - The URL of a metalink file that contains a list of valid mirror repositories.

   • mirrorlist - The URL of a mirrorlist file that contains a list of valid mirror repositories. The remaining fields, such as gpgkey, and metadata_expire, are optional.

     For example:

     {
          "x86_64": [
             {
                 "name": "baseos",
                 "baseurl": "http://mirror.example.com/composes/released/RHEL-8/8.0/BaseOS/x86_64/os/",
                 "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
                 "check_gpg": true
             }
         ]
     }

     Alternatively, you can copy the JSON file for your distribution, by replacing rhel-version.json with your RHEL version, for example: rhel-8.json.

     $  cp /usr/share/osbuild-composer/repositories/rhel-version.json /etc/osbuild-composer/repositories/

4. Optional: Verify the JSON file:

   $ json_verify  /etc/osbuild-composer/repositories/<file>.json

5. Edit the baseurl paths in the rhel-8.json file and save it. For example:

   $ /etc/osbuild-composer/repositories/rhel-version.json

6. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

Procedure

1. Get the baseurl from the /etc/yum.repos.d/redhat.repo file:

   # cat /etc/yum.repos.d/redhat.repo
   [AppStream]
   name = AppStream mirror example
   baseurl = https://mirror.example.com/RHEL-8/8.0/AppStream/x86_64/os/
   enabled = 1
   gpgcheck = 0
   sslverify = 1
   sslcacert = /etc/pki/ca1/ca.crt
   sslclientkey = /etc/pki/ca1/client.key
   sslclientcert = /etc/pki/ca1/client.crt
   metadata_expire = 86400
   enabled_metadata = 0

2. Configure the repository override to use the same baseurl and set rhsm to true:

   {
       "x86_64": [
           {
               "name": "AppStream mirror example",
               "baseurl": "https://mirror.example.com/RHEL-8/8.0/AppStream/x86_64/os/",
               "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
               "check_gpg": true,
               "rhsm": true
           }
       ]
   }

3. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service