APT and DNF/YUM repository layout (local signing)

Revision (v1.0.0-rc1). This document describes how to structure a private or CI-built package repository. It does not publish packages to any remote CDN (no credentials or upload automation in-repo).

Goals

• Host versioned .deb and .rpm artifacts.
• Let clients verify integrity (checksums + optional GPG).
• Support rollback by keeping older package versions alongside metadata.

Debian / Ubuntu (APT)

Typical flat or minimal pool layout:

repo/
  dists/stable/InRelease          # signed metadata (or Release + Release.gpg)
  dists/stable/main/binary-amd64/Packages.gz
  dists/stable/main/binary-amd64/Packages
  pool/main/i/iobackup/iobackup_0.56.0_amd64.deb

Steps (operator):

1. Build .deb (make deb or packages/aptbuild/build-deb.sh).
2. Run dpkg-scanpackages / apt-ftparchive to generate Packages indices.
3. Sign Release with gpg --clearsign or detached signature (Release.gpg).
4. Serve over HTTPS; pin fingerprint on clients (apt-key deprecation: prefer signed-by= keyring snippets in .sources).

Universal .deb note: a single amd64/arm64 binary package is not universally installable across every derivative; test on target LTS. Multi-arch repos need separate binary-* indices per architecture.

AlmaLinux / RHEL / Fedora family (RPM)

Createrepo / createrepo_c layout:

repo/
  repodata/repomd.xml
  repodata/*.xml.gz
  iobackup-0.56.0-1.el9.x86_64.rpm

Steps (operator):

1. Build RPM (make rpm-el9 etc.).
2. createrepo_c <directory> to refresh repodata/.
3. Optional: gpg --detach-sign --armor repodata/repomd.xml.
4. Client: repo_gpgcheck=1 / gpgkey= in .repo file when signatures are used.

Versioning

• DEB Version: field follows the root version file at build time (including prerelease semver such as 1.0.0-rc1).
• RPM Version: / Release: — rpmbuild is invoked with --define "iob_version …" and --define "iob_release …". The Version: field must not contain -; for prereleases in version (e.g. 1.0.0-rc1), build-rpm.sh maps to Version: 1.0.0 and Release: 0.1.rc1 (plus %{?dist}), producing artifacts like iobackup-1.0.0-0.1.rc1.el9.x86_64.rpm while the product semver stays 1.0.0-rc1 in binaries and docs.

Upload policy (manual)

• Never overwrite immutable release artifacts in place; publish new version + refreshed metadata.
• Keep N previous minors for rollback (docs/packaging/upgrade-rollback.md).

Rollback

• Install an older .deb/.rpm from the retained pool after stopping the agent and backing up agent.db (docs/packaging/package-upgrade.md).

See also: docs/packaging/install-deb.md, docs/packaging/install-rpm.md, docs/packaging/packaging-final-report-0.56.md.