Dependably
Request a demo
Dependably Packages · RPM

A private RPM repository for dnf and yum

One .repo file for dnf and yum. Upstream packages come through a pull-through cache that verifies every checksum; your own packages upload with a token; the policy gate decides what reaches a host.

Read the setup guide About Dependably Packages
dnf · yum

Point RPM at your registry

The .repo file holds the literal token, so keep its permissions tight. If anonymous pull is on, the username and password lines can go.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

ini · repo.example.com
# /etc/yum.repos.d/dependably.repo
[dependably]
name=dependably
baseurl=https://repo.example.com/rpm/
enabled=1
username=user
password=<your token>

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

  • The checksum is verified against the digest the upstream publishes before the artefact is stored.
  • The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
  • A name your organization reserves cannot be squatted upstream and resolved into your builds.
  • Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The RPM guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.

Read the setup guide Keep bad packages out of your builds.Know which of your projects are exposed, and whether it matters.