[Yum-devel] [PATCH] package basepath in yum

[David Lutterkort]

On Wed, 2006-02-01 at 13:30 -0500, Dennis Gregorovic wrote:
> So, the end effect is that if xml:base is specified for a package, then
> that url is used instead of the baseurl/mirrorlists value of the repo
> itself.  This essentially provides the capability to do 'virtual'
> repositories as discussed a couple months back on the metadata list.  

Nice .. I just ran into a case where I downloaded something from a guy's
yum repo and spent the better part of an hour trying to chase down all
the dependencies, i.e. finding the right repos that provided dependent
packages. 

There is a bit of a catch-22 with pulling packages in from other repos
though: if those packages are signed, you also need the gpg key for that
repo. If you have that already, chances are that you also have the repo
config for it, in which case yum could have resolved the dependency.

Do you have any support for getting baseurl's into the metadata ? I am
thinking something like telling createrepo to resolve dependencies
against some other repos, and having it set the xml:base accordingly.

To implement this kind of repo remapping/virtual repos reliably, we
would really need a way for a package to say 'I am from repo X', which
in turn requires that there is a way to uniquely specify a repo (e.g.,
with a URL under the control of the repo maintainer), and a way to get a
config for that repo (e.g., by doing a GET on that URL). But all that is
not entirely trivial, especially if you want to avoid malicious repos
hijacking your system.

David