Distributions Reference

A distribution in Repod maps to a target operating system release. When you upload a package, you assign it to one or more distributions. Packages are only visible to apt or dnf/zypper clients configured for that specific distribution.

---

APT distributions

The APT edition supports four distributions out of the box.

Codename	OS	Architecture	Component
jammy	Ubuntu 22.04 LTS	amd64	main
noble	Ubuntu 24.04 LTS	amd64	main
focal	Ubuntu 20.04 LTS	amd64	main
bookworm	Debian 12	amd64	main

APT repository structure

For each distribution, reprepro manages the following tree under /repos/dists/:

/repos/dists/
└── jammy/
    ├── InRelease          ← GPG-signed index (verified by apt clients)
    ├── Release
    ├── Release.gpg
    └── main/
        ├── binary-amd64/
        │   ├── Packages
        │   ├── Packages.gz
        │   └── Packages.xz
        └── Contents-amd64.gz

Adding a distribution

Distributions are initialized automatically at first startup. To add a new distribution manually, modify conf/distributions inside the repository volume and restart the backend, or call the init endpoint:

curl -X POST http://localhost:8000/api/v1/distributions/init \
  -H "Authorization: Bearer $TOKEN"

Modifying built-in distributions

The four supported codenames are hard-coded in services/distributions.py. Adding unsupported codenames requires modifying the source and rebuilding the backend image.

APT client configuration

# /etc/apt/sources.list.d/repod.list
deb http://YOUR_HOST:80/repos jammy main

# Import the signing key
curl -fsSL http://YOUR_HOST:80/repos/dists/jammy/InRelease \
  | gpg --dearmor \
  | sudo tee /etc/apt/trusted.gpg.d/repod.gpg > /dev/null

---

RPM distributions

The RPM edition supports seven distributions.

Codename	OS	Architecture	Grype distro ID
almalinux8	AlmaLinux 8	x86_64	almalinux:8
almalinux9	AlmaLinux 9	x86_64	almalinux:9
rocky8	Rocky Linux 8	x86_64	rockylinux:8
rocky9	Rocky Linux 9	x86_64	rockylinux:9
centos-stream9	CentOS Stream 9	x86_64	centos:9
fedora	Fedora 42	x86_64	fedora:42
opensuse-leap-15.6	openSUSE Leap 15.6	x86_64	opensuse.leap:15.6

Grype distro ID

The Grype distro ID is the identifier passed to grype when scanning a package from that distribution. It determines which CVE advisories are considered relevant. A CentOS CVE may not apply to AlmaLinux even for the same package version — the distro ID ensures accurate matching.

RPM repository structure

For each distribution, createrepo_c manages:

/repos/
└── almalinux9/
    └── x86_64/
        ├── repodata/
        │   ├── repomd.xml            ← Main index
        │   ├── repomd.xml.asc        ← GPG detached signature
        │   ├── primary.xml.gz        ← Package metadata
        │   ├── filelists.xml.gz
        │   └── other.xml.gz
        └── *.rpm                     ← Package binaries

DNF / YUM client configuration

/etc/yum.repos.d/repod.repo

[repod-almalinux9]
name=Repod Private Repository — AlmaLinux 9
baseurl=http://YOUR_HOST:80/repos/almalinux9/x86_64/
enabled=1
gpgcheck=1
gpgkey=http://YOUR_HOST:80/repos/gpg.key
repo_gpgcheck=0

# Import the GPG key
sudo rpm --import http://YOUR_HOST:80/repos/gpg.key
sudo dnf makecache

Zypper client configuration (openSUSE)

sudo zypper addrepo \
  --gpgcheck \
  http://YOUR_HOST:80/repos/opensuse-leap-15.6/x86_64/ \
  repod

sudo rpm --import http://YOUR_HOST:80/repos/gpg.key
sudo zypper refresh repod

---

Distribution promotion

Repod supports promoting a package from one distribution to another without re-uploading or re-scanning. The promotion endpoint copies the package binary and re-runs reprepro includedeb (APT) or createrepo_c --update (RPM) in the target distribution.

curl -X POST http://localhost:8000/api/v1/distributions/promote \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"package":"mypackage","from_dist":"jammy","to_dist":"noble"}'

Role required

Promotion requires the maintainer or admin role.

---

Distribution migration

To migrate all packages from one distribution to another (useful when upgrading your OS baseline):

curl -X POST http://localhost:8000/api/v1/distributions/migrate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"from_dist":"focal","to_dist":"jammy"}'

Migration does not remove the source

The source distribution remains intact after migration. Remove packages manually if needed.