Dependably Packages · RPM
A private RPM repository for dnf and yum
One .repo file for dnf and yum. Upstream packages come through a pull-through cache that verifies every checksum; your own packages upload with a token; the policy gate decides what reaches a host.
dnf · yum
Point RPM at your registry
The .repo file holds the literal token, so keep its permissions tight. If anonymous pull is on, the username and password lines can go.
The placeholders are your base URL and a token from the web UI.
# /etc/yum.repos.d/dependably.repo
[dependably]
name=dependably
baseurl=https://repo.example.com/rpm/
enabled=1
username=user
password=<your token>What happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The RPM guide continues with a verification step, publishing your own packages, and reverting the configuration.