Standards/Rpm Metadata/repomd

From openSUSE

Repository index file

Specification

The current specification is available here, however this specification does not match the current format most tools are using. We offer here alternative specifications:

Current specification plus Novell extensions

Validation

A file named repomd.xml.asc can be present in the same directory as the repomd.xml file.

repomd.xml.asc should be the digital signature from signing repomd.xml file with a trusted key. An optional repomd.xml.key file can exists to provide the key in case the user does not have it. In this case the user should be asked to trust the key or not.

The security model is, the user trusts and accepts the index file, and all the linked files are linked with checksum. So it is not possible to change a listed file without changing the parent index.

Format

This is a Novell extension to the standard. It may not be yet available in the official specification ( http://linux.duke.edu/projects/metadata ) Use this extension with care if you expect compatibility with 3rd party tools.

repomd.rnc file specification in relaxng compact syntax

default namespace = "http://linux.duke.edu/metadata/repo"

element repomd {
  element data {
    attribute type { "other" | "filelists" | "primary" | "group" | "product" | "patches" | "pattern" }&
    element location {
      attribute xml:base { xsd:anyURI }?,
      attribute href { xsd:anyURI },
      empty
    }&
    element checksum {
      attribute type { "md5" | "sha" },
      text
    }&
    element timestamp { xsd:integer }&
    element open-checksum {
      attribute type { "md5" | "sha" },
      text
    }?
  }+&
  text
}

Example repomd file

<?xml version="1.0" encoding="UTF-8"?>
<repomd xmlns="http://linux.duke.edu/metadata/repo">

<data type="primary">
    <location href="repodata/primary.xml.gz"/>
    <checksum type="sha">d70ba931f304a0bc1740deeaaf2a6bff62981ab7</checksum>
    <timestamp>1165253780</timestamp>
    <open-checksum type="sha">35864cccfa0553fce9e43438c70b9bb83f64bc6c</open-checksum>
  </data>
  <data type="filelists">
    <location href="repodata/filelists.xml.gz"/>
    <checksum type="sha">9f2579b7698442e4f419c82c4671be0417ce5627</checksum>
    <timestamp>1165253780</timestamp>
    <open-checksum type="sha">a97b92c82a74a7960d8ab51214983afc38003cbf</open-checksum>
  </data>

The other section lists extra excess data such as changelogs.

  <data type="other">
    <location href="repodata/other.xml.gz"/>
    <checksum type="sha">e4f71c1feb11a717944e43230dd2bc3c6166b36e</checksum>
    <timestamp>1165253780</timestamp>
    <open-checksum type="sha">e132e9230abb26c4395e6d97065907292b0a4845</open-checksum>
  </data>

You can link to a patches file, which list one or more patches.

  <data type="patches">
    <location href="repodata/patches.xml"/>
    <checksum type="sha">1f30e2c0e97a70c3882e525d060c8491c32ab937</checksum>
    <timestamp>1165253780</timestamp>
    <open-checksum type="sha">1f30e2c0e97a70c3882e525d060c8491c32ab937</open-checksum>
  </data>

</repomd>

Proposed changes

The specification here already contains some of the desired changes.

• description and other metadata information to the repository
• list compressed and uncompressed sizes of the files. Useful for displaying progress information when reading compressed files.