Usage RPM

Usage: RPM (dnf / yum)

Publishing

silo publish ./my-package-1.0.0-1.x86_64.rpm --repo myrepo --channel stable

The format is inferred from the file extension; pass --format rpm to be explicit. Publishing is gRPC/CLI-only — there is no HTTP publish path for RPM.

Consuming — private repo (auth enabled)

# /etc/yum.repos.d/silo.repo
[silo-myrepo-stable]
name=Silo myrepo/stable
baseurl=http://silo.internal:8080/myrepo/stable
username=silo
password=silo_xxxxxxxxxxxx_yyyy...
enabled=1
gpgcheck=0   # see Signing, below, for the gpgcheck=1 form

username is ignored by the server — any value works — and the token goes entirely in password, sent as HTTP Basic auth. Use a token with at least read permission scoped to myrepo.

Consuming — public repo (no auth)

Once the repo is public (silo repo set myrepo --mode=public, see Usage), drop username/password entirely:

[silo-myrepo-stable]
name=Silo myrepo/stable
baseurl=http://silo.internal:8080/myrepo/stable
enabled=1
gpgcheck=0

Reads work with no credential. Publishing still requires a write-scoped token regardless of repo mode.

Signing (gpgcheck=1)

If the server has signing.gpg configured (see Setup), RPM packages are signed in place and a detached repomd.xml.asc is written, so both package and repo metadata verification work:

[silo-myrepo-stable]
name=Silo myrepo/stable
baseurl=https://silo.example.com/myrepo/stable
username=silo
password=silo_xxxxxxxxxxxx_yyyy...
enabled=1
gpgcheck=1        # verify package signatures
repo_gpgcheck=1   # verify repomd.xml against repomd.xml.asc
gpgkey=https://silo.example.com/RPM-GPG-KEY-silo

GET /RPM-GPG-KEY-silo returns the armored public half of the configured signing key and is unauthenticated — dnf fetches gpgkey= outside the credentialed repo session, so a token requirement there would break repo_gpgcheck=1 for everyone. It is global, not per-repo: one key signs every repo the server serves. With no signing key configured, the endpoint returns 404.