Distributions Reference¶

A distribution in Repod maps to a target operating system release. When you upload a package, you assign it to a distribution. Packages are only visible to clients (apt, dnf, zypper, apk) configured for that specific distribution.

Which distributions are available depends on REPO_FORMAT (apt, rpm, apk, both, or all) — see Getting Started — Step 2.

APT distributions (`.deb`)¶

Active when REPO_FORMAT is apt, both, or all.

Codename	OS	Architecture	Component
`jammy`	Ubuntu 22.04 LTS	`amd64`	`main`
`noble`	Ubuntu 24.04 LTS	`amd64`	`main`
`focal`	Ubuntu 20.04 LTS	`amd64`	`main`
`bookworm`	Debian 12	`amd64`	`main`

APT repository structure¶

For each distribution, reprepro manages the following tree under /repos/dists/, served by depot-apt:

/repos/dists/
└── jammy/
    ├── InRelease          ← GPG-signed index (verified by apt clients)
    ├── Release
    ├── Release.gpg
    └── main/
        ├── binary-amd64/
        │   ├── Packages
        │   ├── Packages.gz
        │   └── Packages.xz
        └── Contents-amd64.gz

APT client configuration¶

# Import the signing key
curl -fsSL http://YOUR_HOST:80/repos/gpg.key \
  | gpg --dearmor \
  | sudo tee /etc/apt/trusted.gpg.d/repod.gpg > /dev/null

# Add the source
echo "deb http://YOUR_HOST:80/repos jammy main" \
  | sudo tee /etc/apt/sources.list.d/repod.list

sudo apt update

RPM distributions (`.rpm`)¶

Active when REPO_FORMAT is rpm, both, or all.

Codename	OS	Architecture	Package manager	Grype distro ID
`almalinux8`	AlmaLinux 8	`x86_64`	dnf	`almalinux:8`
`almalinux9`	AlmaLinux 9	`x86_64`	dnf	`almalinux:9`
`rocky8`	Rocky Linux 8	`x86_64`	dnf	`rockylinux:8`
`rocky9`	Rocky Linux 9	`x86_64`	dnf	`rockylinux:9`
`centos-stream9`	CentOS Stream 9	`x86_64`	dnf	`centos:9`
`oraclelinux8`	Oracle Linux 8	`x86_64`	dnf	`oraclelinux:8`
`fedora`	Fedora 42	`x86_64`	dnf	`fedora:42`
`opensuse-leap-15.6`	openSUSE Leap 15.6	`x86_64`	zypper	`opensuse/leap:15.6`
`opensuse-tumbleweed`	openSUSE Tumbleweed (rolling)	`x86_64`	zypper	`opensuse/tumbleweed:latest`

Grype distro ID

The Grype distro ID is the identifier passed to grype when scanning a package for that distribution. It determines which CVE advisories are considered relevant — a CVE patched in AlmaLinux 9 may still be open in AlmaLinux 8, so the distro ID ensures accurate matching.

RPM repository structure¶

For each distribution, createrepo_c manages the following tree under /repos/rpm/, served by depot-rpm:

/repos/rpm/
└── almalinux9/
    └── x86_64/
        ├── repodata/
        │   ├── repomd.xml            ← Main index
        │   ├── repomd.xml.asc        ← GPG detached signature
        │   ├── primary.xml.gz        ← Package metadata
        │   ├── filelists.xml.gz
        │   └── other.xml.gz
        └── *.rpm                     ← Package binaries

DNF / YUM client configuration¶

/etc/yum.repos.d/repod.repo

[repod-almalinux9]
name=Repod Private Repository — AlmaLinux 9
baseurl=http://YOUR_HOST:8080/repos/almalinux9/x86_64/
enabled=1
gpgcheck=1
gpgkey=http://YOUR_HOST:8080/repos/gpg.key
repo_gpgcheck=0

sudo rpm --import http://YOUR_HOST:8080/repos/gpg.key
sudo dnf makecache

Zypper client configuration (openSUSE)¶

sudo zypper addrepo \
  --gpgcheck \
  http://YOUR_HOST:8080/repos/opensuse-leap-15.6/x86_64/ \
  repod

sudo rpm --import http://YOUR_HOST:8080/repos/gpg.key
sudo zypper refresh repod

APK distributions (Alpine `.apk`)¶

Active when REPO_FORMAT is apk or all.

Codename	OS	Architecture
`alpine3.18`	Alpine Linux 3.18	`x86_64`
`alpine3.19`	Alpine Linux 3.19	`x86_64`
`alpine3.20`	Alpine Linux 3.20	`x86_64`
`alpine3.21`	Alpine Linux 3.21	`x86_64`

APK repository structure¶

apk index manages the following tree under /repos/apk/, served by depot-apt under /apk/:

/repos/apk/
└── alpine3.20/
    └── main/
        └── x86_64/
            ├── APKINDEX.tar.gz    ← Signed package index
            └── *.apk              ← Package binaries

APK client configuration¶

# Import the signing key
curl -fsSL http://YOUR_HOST:80/apk/repod.rsa.pub \
  -o /etc/apk/keys/repod.rsa.pub

# Add the repository
echo "http://YOUR_HOST:80/apk/alpine3.20/main" \
  | sudo tee -a /etc/apk/repositories

sudo apk update

Adding a distribution¶

Distributions are initialized automatically at first startup (auto_init_distributions()), for every format enabled by REPO_FORMAT. To re-initialize manually (e.g. after restoring a backup without the on-disk distribution trees):

curl -X POST http://localhost:8000/api/v1/distributions/init \
  -H "Authorization: Bearer $TOKEN"

Modifying the supported codename list

The codenames above are hard-coded in services/distributions_apt.py, services/distributions_rpm.py, and services/distributions_apk.py. Adding an unsupported codename requires editing the relevant source file and rebuilding the backend-api image, then calling /api/v1/distributions/init. This is intentional — it prevents accidental distribution sprawl in production.

Distribution promotion¶

Repod supports promoting a package from one distribution to another without re-uploading or re-scanning — the CVE decision and justification are preserved. The promotion endpoint copies the package binary and re-runs reprepro includedeb (APT), createrepo_c --update (RPM), or rebuilds APKINDEX.tar.gz (APK) in the target distribution.

curl -X POST http://localhost:8000/api/v1/distributions/promote \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"package":"mypackage","from_dist":"jammy","to_dist":"noble"}'

Role required

Promotion requires the maintainer or admin role.

Distribution migration¶

To migrate all packages from one distribution to another (useful when upgrading your OS baseline):

curl -X POST http://localhost:8000/api/v1/distributions/migrate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"from_dist":"focal","to_dist":"jammy"}'

Migration does not remove the source

The source distribution remains intact after migration. Remove packages manually if needed.