如何将Yum仓库限制为仅允许特定软件包及其依赖项

Hey there! Based on your experience building custom YUM repos and mirroring public ones, here are a few solid solutions that solve your exact problem—no more manually tracking all dependencies upfront.

1. Pulpcore (Open Source, Enterprise-Grade) #

Pulpcore is a powerful open-source content management system built for managing software repositories (including YUM). It can proxy upstream vendor repos, automatically sync updates to keep packages current, and let you create filtered content sets that include only specific packages and their dependencies without manual listing.

How to set it up for your use case: #

• Install Pulpcore using standard package installs or container deployments for your Linux distro.
• Configure a remote repository pointing to your target vendor YUM repo (this acts as the proxy layer).
• Sync the remote repo to pull all packages temporarily (we’ll filter them next).
• Create a content view (or filtered repository version):
  • Add a filter rule that explicitly includes the package httpd.
  • Enable the "recursive dependency resolution" option—this will automatically pull in all required dependencies (like bash, mailcap, apr, etc.) without you listing each one.
• Publish the filtered content view as a new YUM repo, which your clients can point to.
• Set up a regular sync schedule for the remote repo, and update your content view automatically to include new versions of httpd and its dependencies.

Pros: Fully automated dependency handling, keeps packages up-to-date, supports multiple repos/distros, enterprise-level features like content promotion.
Cons: Has a steeper learning curve compared to lightweight tools.

2. Lightweight Solution: yumdownloader + createrepo (Free, Minimal Setup) #

If you don’t need enterprise-level features, this approach uses tools you’re already familiar with, but adds automated dependency pulling to avoid manual dependency lists.

Steps: #

• Create a directory for your filtered repo, e.g., /var/www/html/restricted-yum-repo/.
• Use yumdownloader with the --resolve flag to pull httpd and all its dependencies from the vendor repo:

  yumdownloader --resolve --destdir=/var/www/html/restricted-yum-repo/ httpd
  

• Run createrepo to generate the repo metadata:

  createrepo /var/www/html/restricted-yum-repo/
  

• To keep packages up-to-date, set up a cron job that clears old packages, re-runs the download command, and regenerates metadata periodically:

  # Example cron job (runs weekly on Sunday at 2AM)
  0 2 * * 0 rm -rf /var/www/html/restricted-yum-repo/* && yumdownloader --resolve --destdir=/var/www/html/restricted-yum-repo/ httpd && createrepo /var/www/html/restricted-yum-repo/
  

Pros: No new tools to learn, uses existing YUM utilities, quick to set up.
Cons: Less granular control than Pulpcore; re-downloads all packages on sync, which can be inefficient for large repos.

3. JFrog Artifactory (Paid, Feature-Rich) #

If you’re open to a paid solution, Artifactory is a universal repository manager that supports YUM repos, proxying, and advanced dependency filtering.

Key features for your use case: #

• Proxy upstream vendor repos and cache packages locally.
• Use repository filters to include only httpd and its transitive dependencies.
• Automatically sync updates from the upstream repo to keep your filtered repo current.
• Provides access control, audit logs, and CI/CD integration if needed.

Pros: User-friendly UI, robust dependency management, enterprise support, multi-repo management.
Cons: Paid license required (a free tier is available for small teams).

Bonus: Using yum-plugin-versionlock (Complementary Tool) #

While not a proxy solution on its own, you can combine this with any of the above to add an extra layer of protection against unwanted packages. Once your filtered repo is set up, lock to your approved packages:

yum versionlock add httpd bash mailcap shadow-utils httpd-tools apr apr-util glibc libdb expat lua pcre libselinux systemd-libs zlib systems

This ensures only your approved packages and versions can be installed or updated.

内容的提问来源于stack exchange，提问作者Illusion