DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
Skip to content
World desk10 min

How to Set Up and Use YUM Repositories on a CentOS VPS

Learn how CentOS VPS repositories work, how to add upstream or vendor sources, how to publish your own RPM repository, and how to verify metadata and package signatures safely.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On a current CentOS Stream VPS, DNF is the command you normally run, while “YUM repository” still describes the repository format and configuration. To add one safely, place a uniquely named repository stanza in /etc/yum.repos.d/, point it at a directory containing valid repodata/ metadata, require package-signature verification with a trusted key, and then inspect or enable the repository deliberately. If you publish your own RPMs, generate and refresh that metadata every time the package set changes.

What a YUM repository is on CentOS

A YUM/DNF repository is a directory of RPM packages plus metadata that tells the package manager which packages exist, which versions they provide, and what dependencies they require. The metadata is normally stored in a repodata/ directory generated from the RPM files. A client does not treat an arbitrary folder of RPMs as a repository; it must be able to download the metadata and then retrieve the packages named by that metadata.

As an Amazon Associate I earn from qualifying purchases.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Newer CentOS Stream installations use dnf as the normal command-line package manager, although administrators and documentation still commonly say “YUM repository.” The configuration model is the same: each repository has an ID in square brackets, and the ID must be unique across all enabled and disabled repository definitions.

Repository definitions belong in individual files ending in .repo under /etc/yum.repos.d/. Keeping a custom repository in its own file makes it easier to inspect, disable, replace, or remove without editing the main DNF configuration. Red Hat’s repository guidance specifically recommends defining repositories in a .repo file rather than putting them in /etc/dnf/dnf.conf.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Decide which repository you are adding

The commands are similar, but the trust and maintenance responsibilities differ depending on the source.

Source What you receive Checks to make before enabling it
CentOS or another upstream Packages maintained for a particular CentOS release and architecture, often selected through a mirrorlist or metalink. Confirm the repository supports the VPS release, uses HTTPS where available, and is currently maintained.
Vendor repository A release package or a manually supplied .repo file, usually with a vendor GPG key. Obtain the release package and key from the project’s current documentation; check signing and update cadence.
Private repository you control RPMs that your team builds or approves, plus metadata you generate and publish. Build for the target CentOS release and architecture, sign packages, protect the private key, and publish both RPMs and metadata over a reachable transport.

Do not assume that a repository built for another CentOS generation or CPU architecture is compatible merely because DNF can download its metadata. Compatibility, provenance, signature verification, update cadence, HTTPS or mirrorlist availability, and default enablement should all be part of your decision.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Prerequisites on the VPS

  • Root access, or an account that can run the required commands through sudo.
  • A network route and DNS resolution to the repository host. If the repository is private, confirm that the VPS can reach it through the required firewall, VPN, or allow-list.
  • The intended CentOS release and architecture. Use repository paths and variables that actually exist for that combination.
  • A plan for the repository’s signing key. You should know who controls it and how key rotation will be handled before enabling packages.
  • A clean naming scheme for repository IDs. Every ID in the [...] stanza must be unique.

Keep production and experimental sources separate. A repository that is disabled by default can still be enabled for one transaction when you need to test a package, without allowing it to influence every future update.

Add an upstream or vendor repository

Prefer a maintained release package

When a project supplies a current release RPM, it is usually safer than copying an old configuration from a blog post. A release package can install the repository file and the project’s public key together, and it can later update those definitions when endpoints change. Read the project’s current instructions first: an archived CentOS SIG page, for example, explicitly warns that its shipped versions are outdated and should not be followed as current setup instructions.

CentOS documentation shows the general pattern of importing a project’s public RPM key and installing its release RPM. Confirm the project, key fingerprint, supported CentOS release, and package freshness before you run the installation. Keep a record of which release package supplied each file under /etc/yum.repos.d/.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Create a manual .repo file

Manual configuration is appropriate when the publisher does not provide a release package or when you operate the repository yourself. Create a separate file such as /etc/yum.repos.d/example.repo:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
[example]
name=Example RPM repository
baseurl=https://repo.example.invalid/centos/$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://repo.example.invalid/RPM-GPG-KEY-example

The URL above is an illustrative layout; replace it with the real HTTPS endpoint published for your CentOS release and architecture. The endpoint must represent a repository directory, not the URL of one RPM. In particular, the directory addressed by baseurl must contain (or expose) repodata/.

  • [example] is the repository ID. Choose a concise name and do not reuse it in another file.
  • name is the human-readable label shown by repository-listing commands.
  • baseurl is the repository directory. $releasever and $basearch are substituted by DNF; verify that the resulting paths exist on your server.
  • enabled=1 makes the source available for normal transactions. Use enabled=0 for a repository you want to keep installed but opt into explicitly.
  • gpgcheck=1 requires RPM package signatures to be checked.
  • gpgkey identifies the trusted public key location. It can be a reachable URL or a local key path, depending on how you provision keys.

Write the file with root ownership and ordinary read permissions. Avoid placing credentials in a world-readable URL; for a private repository, use an access method appropriate to your infrastructure and protect any client secrets.

Add a URL with DNF’s configuration helper

DNF can generate a repository definition from a URL:

sudo dnf config-manager --add-repo <repository_URL>

Repositories added this way are enabled by default. Inspect the generated file under /etc/yum.repos.d/ immediately, check the ID and URL, and adjust signing settings if the publisher’s instructions require it. To stop using a repository without deleting its definition:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo dnf config-manager --disable <repository_id>

Build a private RPM repository

Install the metadata generator and stage packages

Use a repository host or a controlled staging directory. Install createrepo_c; on systems where that package is not provided, use the package named createrepo:

sudo dnf install -y createrepo_c   # use createrepo where that is the package provided
sudo mkdir -p /srv/repos/example
sudo cp /path/to/packages/*.rpm /srv/repos/example/
sudo createrepo_c /srv/repos/example/

The final command scans the RPMs and creates /srv/repos/example/repodata/. The RPMs should all be intended for the CentOS release and architectures that your clients will use. Metadata generation does not repair an incompatible binary, missing dependency, or incorrect build target.

Publish the repository directory

Expose /srv/repos/example/ through an HTTPS web server or another transport that every authorized VPS can reach. Set the client’s baseurl to the directory containing repodata/. A common mistake is pointing baseurl at a single RPM or at the parent directory above the repository; either choice prevents DNF from finding the expected metadata.

Before enabling the source broadly, test the endpoint from a VPS. Confirm that the metadata files and the RPM paths returned by that metadata are accessible with the same hostname and authentication that DNF will use.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Refresh metadata after package changes

When you add, remove, or replace RPMs, regenerate metadata and then clear client-side metadata caches:

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo createrepo_c --update /srv/repos/example/
sudo dnf clean all
sudo dnf makecache

--update preserves and updates existing metadata where possible. The cache-clearing step matters when a VPS has already seen an older repository state; without it, DNF may continue using stale metadata and fail to show a newly published package.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Sign packages and repository metadata

Protect and distribute the package key

Sign every RPM with the private key controlled by the repository owner, and keep that private key off the VPS whenever possible. Distribute only the public key. Import it on a client before enabling strict verification, or let the repository’s gpgkey= setting identify the key location. Verify the fingerprint through a trusted channel; downloading a key from the same unverified endpoint as the packages does not establish trust by itself.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

With gpgcheck=1, DNF checks the signature on each package it installs. A failed check is a supply-chain warning, not a reason to bypass verification. Do not permanently “fix” a key problem by setting gpgcheck=0.

Sign repository metadata as well

Package signatures protect individual RPMs, while a signed repomd.xml helps protect the repository’s metadata description. After generating metadata, sign repodata/repomd.xml with the repository key and publish the detached signature in the form expected by your DNF/YUM tooling. Red Hat’s guidance describes enabling repository-metadata checking with check_repogpg = true; other configurations expose the equivalent repository option as repo_gpgcheck=1. Use the spelling and placement documented for the DNF version installed on your VPS, and test verification on a disposable client before making it a production requirement.

Rotate keys deliberately. Publish the new public key before signing with it, keep the old key available long enough for existing clients to update, and document which repository files and packages were signed by each key.

Inspect, enable, and use the repository

List configured sources

sudo dnf repolist

This shows enabled repositories and their IDs. For more detail, inspect the generated .repo file and use DNF’s verbose repository output when you need to see the resolved URLs, enabled state, and architecture paths.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Test one repository without changing global defaults

sudo dnf --disablerepo='*' --enablerepo=example list available

This limits the query to the repository named example. It is useful for confirming that metadata is readable and for preventing an experimental source from silently satisfying dependencies from unrelated repositories.

Install and update packages

sudo dnf install package-name
sudo dnf update

Review the transaction summary, repository IDs, and package signatures before confirming an install or update on a production VPS. If the repository is disabled by default, enable it only for the transaction that needs it by using the --enablerepo=<repo_id> pattern.

Troubleshoot repository problems systematically

DNF reports no packages or cannot find the repository

  • Open the repository URL from the VPS and verify that the path contains repodata/, not just RPM files.
  • Check that $releasever and $basearch resolve to directories that actually exist on the server. A URL copied from another CentOS release often fails here.
  • Run sudo dnf repolist and inspect whether the repository ID is enabled and spelled exactly as in the file.
  • If the repository was recently rebuilt, follow the metadata-refresh sequence in the private-repository section, including client cache cleanup.
  • Check HTTPS certificates, DNS, firewall rules, and any authentication required by the repository host.

GPG or signature errors

  • Confirm that the public key installed on the VPS matches the publisher’s documented fingerprint.
  • Verify that the gpgkey URL or local path is reachable and that the key has not expired or been replaced.
  • Check the package signature and, if metadata checking is enabled, the signature associated with repomd.xml.
  • Do not disable gpgcheck as a permanent workaround. Fix the key distribution, signing, or repository configuration instead.

A newly published RPM is missing

The package manager reads metadata, not a live directory listing. Regenerate the repository metadata after copying the RPM, then clear the client’s metadata cache and rebuild it. Also confirm that the RPM’s name, version, release, and architecture match the query you are making; a package can be present but excluded because it is not compatible with the VPS.

Dependency, release, or architecture failures

Ensure that every RPM was built for the target CentOS release and VPS architecture, and that all required dependencies are available from trusted, compatible repositories. Metadata can accurately describe an RPM that still cannot run on your system. Avoid mixing repositories intended for different releases unless the publisher explicitly documents that combination.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Unexpected or obsolete content appears

Re-check the project’s current documentation and status. CentOS SIG instructions can remain online after a project has been archived; one CentOS page explicitly labels its quickstart obsolete and says not to follow it. Treat an old release RPM, stale key, or abandoned mirror as a maintenance and security risk, even if DNF can still download from it.

Repository maintenance and operating practices

  • Keep custom definitions in separate .repo files so upgrades and troubleshooting do not overwrite them.
  • Use descriptive, unique IDs and record the owner, purpose, supported releases, architectures, and signing-key fingerprint.
  • Leave experimental repositories disabled by default and enable them for a single transaction when practical.
  • Regenerate metadata as part of every repository publication job; publish the updated metadata and packages atomically so clients do not observe a half-updated tree.
  • Monitor HTTPS certificate expiry, mirror or web-server availability, key rotation dates, and package update cadence.
  • Test repository changes on a disposable VPS before applying them to production systems, especially when changing signing keys or release paths.
  • Keep a rollback plan: preserve the previous repository snapshot and know how to disable the repository if a package or metadata publication is defective.

A practical validation checklist

  1. Confirm the VPS release, architecture, network access, and administrative privileges.
  2. Choose an upstream, vendor, or private source with a current maintenance owner.
  3. Install the maintained release package, or create one uniquely named file under /etc/yum.repos.d/.
  4. Check that baseurl resolves correctly and exposes repodata/.
  5. Enable gpgcheck=1, install or reference the trusted public key, and verify its fingerprint.
  6. For a private source, generate metadata with createrepo_c (or createrepo), sign packages, and configure metadata-signature checking as supported by your DNF version.
  7. Run dnf repolist, then test with --disablerepo='*' --enablerepo=<repo_id>.
  8. After package changes, regenerate metadata, clear client caches, and rebuild the cache before diagnosing a missing package.
  9. Disable or remove any source that is obsolete, untrusted, incompatible, or no longer maintained.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.