LFCS 52 🐧 Repository Configuration - KandZ

⏱️ Estimated read: 12 min | |

Repository configuration is the layer that tells a package manager where to find software. On RHEL-based systems, the package manager (DNF or YUM) reads repository definitions from .repo files in /etc/yum.repos.d/ and from the [main] section of /etc/yum.conf . On Debian-based systems, APT reads from /etc/apt/sources.list and the drop-in directory /etc/apt/sources.list.d/, either in the one-line format or the newer deb822 format . The LFCS exam explicitly lists “search, install, verify, and maintain software packages or repositories” as part of the Operations Deployment domain, which carries 25% of the exam weight . The distinction between adding a repository and enabling it, and between the RHEL and Debian approaches, is the core of the topic.

A repository definition is not the same as an installed package. Adding a repository makes its packages available; installing a package from it is a separate step. The repository file contains the metadata the package manager needs: the repository ID, the human-readable name, the base URL (or metalink), the GPG key location, and the enabled/disabled flag. On RHEL, the gpgcheck=1 directive tells DNF to verify the signature of every package from that repository, and gpgkey= points to the public key that performs the verification . On Debian, the GPG key is stored in a keyring, and the signed-by= option in the source line points to that keyring .

Key point: On RHEL-based systems, repositories are defined in .repo files under /etc/yum.repos.d/ and managed with yum-config-manager --add-repo, --enable, and --disable. On Debian-based systems, repositories are defined in /etc/apt/sources.list or /etc/apt/sources.list.d/, added with add-apt-repository, and activated with apt update. Adding a repository does not install anything; it only makes the packages available.

Why repository configuration is separate from package installation

The trust problem. A package manager that installed software from any URL without verification would be a root-level remote code execution vector. The gpgcheck directive on RHEL and the signed-by option on Debian exist to ensure that the packages come from the entity that holds the private key. When you add a third-party repository, you are trusting its maintainer to sign packages correctly and to not distribute malicious code. The Red Hat documentation warns explicitly that installing packages from unverified sources is a security risk .

The enable/disable problem. A repository can be defined but disabled. The enabled=0 flag in a RHEL .repo file means the repository is present but its packages are not considered during installation or updates . This is useful for repositories that should only be used on demand—a testing repository, a legacy package source, or a repository that conflicts with the primary one. The yum-config-manager --enable and --disable commands toggle the flag without editing the file .

The priority problem. When the same package exists in multiple repositories, the package manager must choose which one to install. RHEL’s DNF supports repository priorities through the priority= directive (provided by the dnf-plugin-priorities package). A lower number means higher priority. Debian’s APT uses the order of the sources and the Pin-Priority mechanism for the same purpose. Without a priority, the package manager may choose a version from a third-party repository over the distribution’s own, which can cause dependency conflicts.

The cache problem. The package manager does not read the repository’s package list on every command. It downloads the metadata to a local cache and reads from the cache. On RHEL, dnf makecache refreshes the cache . On Debian, apt update refreshes the package index . Without the refresh, a newly added repository’s packages do not appear in the search results, and a newly published version does not appear as an upgrade. This is the most common reason a newly added repository “does not work.”

a. RHEL-based repository configuration: `.repo` files and `yum-config-manager`

The .repo file is the standard format on RHEL, CentOS, Fedora, Rocky, and AlmaLinux. Each file can contain one or more repository sections, and the filename does not matter as long as it ends in .repo. The package manager reads every .repo file in /etc/yum.repos.d/ .

A minimal repository section has five fields: the repository ID in brackets, the name, the base URL, the enabled flag, and the GPG check flag.

# /etc/yum.repos.d/custom.repo

# The repository ID is the unique identifier
# It is used by yum-config-manager --enable/--disable
[custom]
name=Custom Repository
# The base URL is the directory that contains the repodata/
baseurl=http://example.com/repo/
# enabled=1 means the repository is used for install and update
enabled=1
# gpgcheck=1 means every package signature is verified
gpgcheck=1
# gpgkey points to the public key that verifies the signature
gpgkey=http://example.com/repo/RPM-GPG-KEY-custom

The baseurl can also be a metalink, which is a URL that returns a list of mirrors. The metalink approach is more robust because it allows the package manager to choose a working mirror if the primary is unavailable . The $releasever and $basearch variables are resolved at runtime, so the same .repo file works across RHEL 8 and 9 and across x86_64 and aarch64 .

The yum-config-manager command is the tool for adding and toggling repositories without editing the file manually. --add-repo downloads a .repo file from a URL and places it in /etc/yum.repos.d/. The repository is enabled by default after this command .

# Add a repository from a .repo file URL
# The file is downloaded to /etc/yum.repos.d/
sudo yum-config-manager --add-repo http://example.com/custom.repo

# List all repositories, including disabled ones
yum repolist all

# Enable a repository by its ID
sudo yum-config-manager --enable custom

# Disable a repository by its ID
sudo yum-config-manager --disable custom

The yum repolist command is the verification step. It lists the repositories that are currently enabled and the number of packages in each. yum repolist all includes the disabled repositories, which is how you confirm that a repository was added but is not active .

b. Debian-based repository configuration: `sources.list` and `add-apt-repository`

Debian and Ubuntu use a different format. The classic one-line format has four fields: the type (deb for binary packages, deb-src for source packages), the URI, the suite (a release codename like jammy or trixie), and the components (main, contrib, non-free, non-free-firmware) .

# /etc/apt/sources.list.d/custom.list

# deb: binary packages
# The URI points to the repository root
# jammy is the suite (Ubuntu 22.04)
# main is the component
deb http://example.com/ubuntu jammy main

The add-apt-repository command is the tool for adding a PPA (Personal Package Archive) on Ubuntu. A PPA is a Launchpad-hosted repository maintained by an individual or team. The command expands the ppa:user/name shorthand into the full deb line, writes it to a new file in /etc/apt/sources.list.d/, and downloads the GPG key to the APT keyring .

# Add a PPA
# The command writes the source line and imports the GPG key
sudo add-apt-repository ppa:graphics-drivers/ppa

# Refresh the package index so the new repository's packages appear
sudo apt update

# The packages are now available for installation
sudo apt install nvidia-driver-550

The add-apt-repository command does not run apt update automatically in all versions. The Ubuntu documentation shows the two commands in sequence, and the apt update is required for the new repository to take effect . The -y flag skips the confirmation prompt, and the --remove flag removes a repository that was previously added.

For a repository that is not a PPA, the add-apt-repository command accepts a full deb line with the --sourceslist flag, or a URI with --uri. The manual approach is to create a .list file in /etc/apt/sources.list.d/ and run apt update. The GPG key must be imported separately with gpg or apt-key (deprecated) .

Complete Example Session

The following session adds a third-party repository on both RHEL and Debian, verifies it, enables and disables it, and installs a package from it.

# ============================================
# PART 1: RHEL — ADD A REPOSITORY
# ============================================
# Add the repository from a .repo file URL
sudo yum-config-manager --add-repo http://example.com/custom.repo

# The file is written to /etc/yum.repos.d/
# Verify the content
cat /etc/yum.repos.d/example.com_custom.repo

# ============================================
# PART 2: RHEL — VERIFY AND ENABLE
# ============================================
# List all repositories, including disabled ones
yum repolist all

# If the repository is disabled, enable it by ID
sudo yum-config-manager --enable custom

# Refresh the cache
sudo dnf makecache

# ============================================
# PART 3: RHEL — INSTALL FROM THE REPOSITORY
# ============================================
# Install a package that is only in the custom repository
sudo dnf install custom-package

# ============================================
# PART 4: DEBIAN — ADD A PPA
# ============================================
# Add the PPA
sudo add-apt-repository ppa:graphics-drivers/ppa

# Refresh the package index
sudo apt update

# ============================================
# PART 5: DEBIAN — INSTALL FROM THE PPA
# ============================================
# Install a package from the PPA
sudo apt install nvidia-driver-550

# ============================================
# PART 6: DEBIAN — REMOVE THE PPA
# ============================================
# Remove the PPA and its source line
sudo add-apt-repository --remove ppa:graphics-drivers/ppa

# Refresh the index
sudo apt update

The six parts cover adding a repository on RHEL, verifying and enabling it, installing from it, adding a PPA on Debian, installing from it, and removing it. What the session demonstrates is that the RHEL and Debian workflows are different in their commands and file formats, but the sequence is the same: add the repository, refresh the index, install the package.

Quick Reference

RHEL Repository Files

Path	Purpose
`/etc/yum.repos.d/*.repo`	Repository definitions
`/etc/yum.conf`	Main config with `[main]` and repo sections
`/var/cache/dnf/`	Package metadata cache

RHEL Commands

Command	Effect
`yum-config-manager --add-repo URL`	Add repository from URL
`yum-config-manager --enable ID`	Enable repository
`yum-config-manager --disable ID`	Disable repository
`yum repolist`	List enabled repositories
`yum repolist all`	List all repositories
`dnf makecache`	Refresh metadata cache

Debian Repository Files

Path	Purpose
`/etc/apt/sources.list`	Main repository list
`/etc/apt/sources.list.d/*.list`	Drop-in repository files
`/etc/apt/trusted.gpg.d/`	GPG keyrings

Debian Commands

Command	Effect
`add-apt-repository ppa:user/name`	Add a PPA
`add-apt-repository --remove ppa:...`	Remove a PPA
`apt update`	Refresh package index
`apt install pkg`	Install from repository

Best Practices

✅ Do This:

# RHEL: use a .repo file in /etc/yum.repos.d/
sudo yum-config-manager --add-repo http://example.com/custom.repo

# Debian: use add-apt-repository for PPAs
sudo add-apt-repository ppa:user/name && sudo apt update

# Verify the repository is enabled before installing
yum repolist all

❌ Don’t Do This:

# Disable gpgcheck on a production repository
gpgcheck=0 # skips signature verification

# Forget to run apt update after adding a repository
sudo add-apt-repository ppa:user/name # packages not visible yet

# Use apt-key (deprecated) instead of a keyring
sudo apt-key adv --recv-keys KEYID

Common Pitfalls

Pitfall	Why It Happens	Fix
Package not found after adding repo	Cache not refreshed	`dnf makecache` or `apt update`
GPG error on install	Key not imported	Add `gpgkey=` or import the key
Repository ignored	`enabled=0`	`yum-config-manager --enable`
PPA install fails	Wrong Ubuntu suite	Check the PPA supports your release
Third-party package overrides distro	No priority set	Set `priority=` in the `.repo` file

Real-World Examples

1. RHEL: add a repository

sudo yum-config-manager --add-repo http://example.com/custom.repo

2. RHEL: enable a repository

sudo yum-config-manager --enable custom

3. RHEL: verify

yum repolist all

4. RHEL: refresh cache

sudo dnf makecache

5. Debian: add a PPA

sudo add-apt-repository ppa:graphics-drivers/ppa

6. Debian: refresh index

sudo apt update

7. Debian: install from PPA

sudo apt install nvidia-driver-550

8. Debian: remove a PPA

sudo add-apt-repository --remove ppa:graphics-drivers/ppa

9. Manual `.repo` file

[custom]
name=Custom
baseurl=http://example.com/repo/
enabled=1
gpgcheck=1

10. Manual `.list` file

deb http://example.com/ubuntu jammy main

Visual

RHEL Repository Flow

┌──────────────────────────────────────────────┐
│  /etc/yum.repos.d/*.repo                     │
│  [custom]                                    │
│  baseurl=http://example.com/repo/            │
│  enabled=1                                   │
│  gpgcheck=1                                  │
│         │                                    │
│         ▼                                    │
│  dnf makecache                               │
│         │                                    │
│         ▼                                    │
│  /var/cache/dnf/ (metadata)                  │
│         │                                    │
│         ▼                                    │
│  dnf install pkg                             │
└──────────────────────────────────────────────┘

Debian Repository Flow

┌──────────────────────────────────────────────┐
│  /etc/apt/sources.list.d/custom.list         │
│  deb http://example.com/ubuntu jammy main    │
│         │                                    │
│         ▼                                    │
│  apt update                                  │
│         │                                    │
│         ▼                                    │
│  /var/lib/apt/lists/ (index)                 │
│         │                                    │
│         ▼                                    │
│  apt install pkg                             │
└──────────────────────────────────────────────┘

Enable vs Disable

┌──────────────────────────────────────────────┐
│  enabled=1  → packages available             │
│  enabled=0  → packages ignored               │
│                                              │
│  yum-config-manager --enable custom          │
│  → sets enabled=1 in the .repo file          │
│                                              │
│  yum-config-manager --disable custom         │
│  → sets enabled=0 in the .repo file          │
└──────────────────────────────────────────────┘

Summary

Item	Value
RHEL repo path	`/etc/yum.repos.d/*.repo`
RHEL add command	`yum-config-manager --add-repo`
RHEL enable	`yum-config-manager --enable`
RHEL cache refresh	`dnf makecache`
Debian repo path	`/etc/apt/sources.list.d/`
Debian add command	`add-apt-repository`
Debian cache refresh	`apt update`
GPG check (RHEL)	`gpgcheck=1` + `gpgkey=`
GPG key (Debian)	Keyring + `signed-by=`

Key takeaways:

Repository configuration is separate from package installation. Adding a repository makes its packages available; installing a package is a separate command. The repository file defines where the packages come from and how they are verified .
RHEL and Debian use different formats and commands. RHEL uses .repo files in /etc/yum.repos.d/ and yum-config-manager. Debian uses sources.list or .list files in /etc/apt/sources.list.d/ and add-apt-repository .
The cache must be refreshed after adding a repository. dnf makecache on RHEL and apt update on Debian download the package metadata. Without the refresh, the new repository’s packages are invisible .
GPG verification is the trust mechanism. gpgcheck=1 and gpgkey= on RHEL, and the keyring plus signed-by= on Debian, ensure that the packages are signed by the repository owner .
A repository can be defined but disabled. enabled=0 means the repository exists but is not used. yum-config-manager --enable toggles it without editing the file .
PPAs are Ubuntu’s third-party repository mechanism. add-apt-repository ppa:user/name adds the source line and imports the GPG key in one command .

Remember: Repository configuration is the step that connects the package manager to the source of software. On RHEL, the .repo file in /etc/yum.repos.d/ is the unit, and yum-config-manager is the tool. On Debian, the source line in /etc/apt/sources.list.d/ is the unit, and add-apt-repository is the tool. Both require a cache refresh before the new packages appear, and both rely on GPG verification to ensure that the packages are authentic. The LFCS exam expects you to know both systems, because the exam is distribution-neutral and the objectives list “search, install, verify, and maintain software packages or repositories” without specifying which distribution’s tools you will use .

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!