[Yum-devel] [PATCH] package basepath in yum

[seth vidal]

On Wed, 2006-02-01 at 16:39 -0800, David Lutterkort wrote:
> On Wed, 2006-02-01 at 13:30 -0500, Dennis Gregorovic wrote:
> > So, the end effect is that if xml:base is specified for a package, then
> > that url is used instead of the baseurl/mirrorlists value of the repo
> > itself.  This essentially provides the capability to do 'virtual'
> > repositories as discussed a couple months back on the metadata list.  
> 
> Nice .. I just ran into a case where I downloaded something from a guy's
> yum repo and spent the better part of an hour trying to chase down all
> the dependencies, i.e. finding the right repos that provided dependent
> packages. 
> 
> There is a bit of a catch-22 with pulling packages in from other repos
> though: if those packages are signed, you also need the gpg key for that
> repo. If you have that already, chances are that you also have the repo
> config for it, in which case yum could have resolved the dependency.
> 
> Do you have any support for getting baseurl's into the metadata ? I am
> thinking something like telling createrepo to resolve dependencies
> against some other repos, and having it set the xml:base accordingly.
> 
> To implement this kind of repo remapping/virtual repos reliably, we
> would really need a way for a package to say 'I am from repo X', which
> in turn requires that there is a way to uniquely specify a repo (e.g.,
> with a URL under the control of the repo maintainer), and a way to get a
> config for that repo (e.g., by doing a GET on that URL). But all that is
> not entirely trivial, especially if you want to avoid malicious repos
> hijacking your system.

well createrepo's -u option forces xml:base to be specified. This
attribute was added to allow people to have some packages in the
metadata that had a specific url and not the mirror-able url. This was
to handle licensed/access-controlled packages.

what I'm confused about in the patch by Dennis is why anyone would want
to set the url this way. ie: what benefit do you get?

-sv