Skip to content
Private S3 Package Repo

Package formats

Overview

Section titled “Overview”

The lab publishes one sample RPM (AL2023 / dnf) and one sample deb (Ubuntu 24.04 / apt) under a shared repos/ prefix. After each Put, the rebuild Lambda rebuilds indexes and signs repo metadata so consumers can trust the tree the usual way (repo_gpgcheck / signed-by).

S3 layout

Section titled “S3 layout”
Format Tree Packages Indexes
RPM repos/rpm/al2023/x86_64/ Packages/*.rpm repodata/ (repomd.xml, repomd.xml.asc, …)
Deb repos/deb/ubuntu/noble/ pool/main/…/*.deb dists/noble/ (Packages, Release, InRelease, …)

Publisher IAM is intentionally narrow: Put under …/Packages/* and …/pool/* only. Index objects, signatures, and catalog.json are written by the rebuild Lambda, not by the publisher role.

S3 package trees under repos/ Primary package bucket layout: publisher Puts under Packages/ and pool/; Lambda writes repodata, dists, and GPG signatures. Both trees sit under repos/. repos/ layout on the primary package bucket ps3p-pkgs-&-syd private repos/ RPM (dnf / AL2023) repos/rpm/al2023/x86_64/ Packages/*.rpm publisher Put repodata/repomd.xml Lambda repodata/repomd.xml.asc Lambda (gpg) createrepo_c � detach-sign repomd.xml Deb (apt / Ubuntu noble) repos/deb/ubuntu/noble/ pool/main/&/*.deb publisher Put dists/&/Packages(.gz) Lambda dists/&/InRelease Lambda (gpg) apt-ftparchive � clearsign Release Who writes what Publisher role Packages/* and pool/* only Rebuild Lambda indexes + GPG metadata + catalog.json on UI bucket CRR copies all of repos/ packages, indexes, and signatures to the Auckland replica Not package re-signing  repo metadata only (repomd / InRelease)

Index tools

Section titled “Index tools”
Tool Role
createrepo_c
createrepo_c builds yum/dnf repodata (repomd.xml and friends) for an RPM tree so dnf can resolve packages.		 Builds or updates yum/dnf repodata for the RPM tree
apt-ftparchive Builds Packages / Packages.gz and Release for the deb tree
gpg Detach-signs repomd.xml; clearsigns Release → InRelease

Those tools run inside the same rebuild Lambda container image. EventBridge triggers the function on Packages/*.rpm and pool/*.deb Puts to the primary (demo.sh publish waits for that rebuild). The Lambda writes indexes and signatures next to the packages and refreshes catalog.json plus the public key on the UI bucket (and repos/gpg/lab-signing.asc on the package bucket for VPCE consumers).

Metadata signing

Section titled “Metadata signing”

Signing is repo metadata, not re-signing the sample EPEL/Ubuntu packages:

  1. up-shared creates a lab GPG keypair. The private key lands in Secrets Manager; the public key is published for consumers (UI bucket / repos/).
  2. After indexes are built, the Lambda imports the private key into an ephemeral GNUPGHOME under /tmp, signs, uploads, and discards the keyring.
  3. Consumers install the public key, then use repo_gpgcheck=1 (dnf) and signed-by= (apt).

That fits the existing function (2048 MB / 300s): signing is milliseconds next to S3 sync and index rebuild. A separate signer Lambda is not needed for this lab.

Rebuild Lambda indexes and signs repo metadata Publisher Puts rpm/deb under repos/. EventBridge invokes the rebuild Lambda, which pulls the lab GPG private key from Secrets Manager, runs createrepo_c and apt-ftparchive, signs metadata, writes indexes back to the package bucket, and refreshes catalog.json plus the public key on the UI bucket. Index rebuild + metadata signing (same Lambda) Publisher Put .rpm / .deb S3 pkgs repos/ EventBridge Object Created Rebuild Lambda createrepo / apt-ftparchive + gpg sign Secrets Manager lab GPG private key Indexes + sigs repomd.xml.asc InRelease UI bucket catalog.json + public GPG key Consumer repo_gpgcheck=1 signed-by= Private key stays in Secrets Manager; Lambda imports into ephemeral GNUPGHOME under /tmp per invoke