DNF4.CONF(5)

📦

version 4.24.0 · 9 versions

4.24.0 · ubuntu resolute, ubuntu stonking (latest)
4.24.0 · nixos 26.05
4.20.0 · centos-stream 10
4.24.0 · nixpkgs unstable
4.24.0 · arch rolling
4.24.0 · fedora 43
4.23.0 · fedora 43
4.24.0 · fedora 44
4.23.0 · debian trixie, ubuntu questing

🎀 NAME 🎀

hey bestie, welcome to dnf4.conf(5) — the DNF Configuration Reference, i.e. the sacred text of "how tf do I tell dnf what I want" 💅 bookmark it, you'll be back.

📖 DESCRIPTION 📖

DNF (the source lives at https://github.com/rpm-software-management/dnf/) by default reads the global config file at /etc/dnf/dnf.conf plus every *.repo file it finds under /etc/yum.repos.d. That second location is typically where your repository config hangs out, and it takes precedence over the global config. okay so like, repo files win, noted 📝

The config file is in INI format — that means a section declaration, then name=value options, each one on its own separate line underneath. There are exactly two flavors of section in these files: main and repository.

The main section holds all the global configuration options, and there should only ever be one of them. one main section. not two. don't do it 💀
The repository sections define the config for each (remote or local) repo. The section name in brackets is the repo ID reference, and it needs to be unique across all your config files.

The characters allowed in a repo ID string are: lower and upper case alphabetic letters, digits, -, _, . and :. that's the whole guest list, no plus-ones 🎟️

The minimal repository config file should — aside from the repo ID — consist of a baseurl, metalink or mirrorlist option definition. one of those three, pick your fighter ✨

🌈 DISTRIBUTION-SPECIFIC CONFIGURATION 🌈

A couple of options — specifically best and skip_if_unavailable — can be set in the DNF configuration file by your distribution, so they can override the DNF defaults. your distro gets to have an opinion here, respect it 🫶

👑 [MAIN] OPTIONS 👑

okay beloved, this is the big one. main character energy only.

allow_vendor_change boolean — if it's disabled, dnf will stick to the vendor when upgrading or downgrading rpms. Default is True.

⚠️ Warning: this option is currently not supported for the downgrade and distro-sync commands.

arch string — the architecture used for installing packages. By default it's auto-detected. Often used together with the ignorearch option.
assumeno boolean — if enabled, dnf will assume No wherever it would normally stop and prompt you for confirmation. Default is False.
assumeyes boolean — if enabled, dnf will assume Yes wherever it would normally prompt you for confirmation (peep defaultyes too). Default is False.
autocheck_running_kernel boolean — automatic check whether there's an installed newer kernel module with a security update than the kernel you're currently running. Default is True.
basearch string — the base architecture used for installing packages. By default this is auto-detected.
best boolean — True tells the solver to either use a package with the highest available version or just fail. On False, don't fail if the latest version can't be installed — go with the lower version. Default is False. Lowkey important: this option in particular can be set in your config file by your distribution. Also, the use of the highest available version is only guaranteed for the packages directly requested, not for their dependencies. so no, it doesn't magically drag the whole dep tree to latest, sorry bestie 😭
cachedir string — path to a directory used by various DNF subsystems for storing cache data. It has a reasonable root-writable default depending on the distribution. DNF needs to be able to create files and directories at this location. it needs write access, periodt.
cacheonly boolean — if set to True, DNF will run entirely from the system cache, will not update the cache, and will use it even if it's expired. Default is False.

API Notes: must be set before repository objects are created. Plugins must set this in the pre_config hook. Later changes are ignored. (the way that timing matters here… 🕐)

check_config_file_age boolean — specifies whether dnf should automatically expire the metadata of repos that are older than their corresponding configuration file (usually the dnf.conf file and the foo.repo file). Default is True (perform the check). The expiring of metadata is also affected by metadata age — see also metadata_expire.
clean_requirements_on_remove boolean — remove dependencies that are no longer used during dnf remove. A package only qualifies for removal via clean_requirements_on_remove if it was installed through DNF but not on explicit user request — i.e. it got pulled in as a dependency. Default is True. (installonlypkgs are never automatically removed. never ever 🙅)
config_file_path string — path to the default main configuration file. Default is /etc/dnf/dnf.conf.
debuglevel integer — debug messages output level, in the range 0 to 10. The higher the number, the more debug output gets put to stdout. Default is 2.
debug_solver boolean — controls whether the libsolv debug files should be created when solving the transaction. The debug files are created in the ./debugdata directory. Default is False.
defaultyes boolean — if enabled, the default answer to user confirmation prompts will be Yes. Not to be confused with assumeyes, which won't prompt at all. Default is False. one of them asks, one of them doesn't — they are not the same girl 💅
diskspacecheck boolean — controls whether rpm should check available disk space during the transaction. Default is True.
errorlevel integer — error messages output level, in the range 0 to 10. The higher the number, the more error output gets put to stderr. Default is 3. This is deprecated in DNF and overwritten by the --verbose commandline option.
exclude_from_weak list — prevent installing packages as weak dependencies (recommends or supplements). The packages can be specified by a name or a glob, separated by a comma. Defaults to [].
exclude_from_weak_autodetect boolean — if enabled, dnf will autodetect unmet weak dependencies (recommends or supplements) of packages installed on the system. Providers of these weak dependencies will not be installed by dnf as weak dependencies any more (they will still be installed if pulled in as a regular dependency). Defaults to true. so they don't get to sneak in the weak-deps door, but the front door is still open 🚪
exit_on_lock boolean — should the dnf client exit immediately when something else has the lock. Default is False.
gpgkey_dns_verification boolean — should dnf attempt to automatically verify GPG verification keys using the DNS system. This option requires the unbound python module (python3-unbound) to be installed on the client system. This system has two main features:
- The first one is to check if any of the already installed keys have been revoked. Automatic removal of the key is not yet available, so it is up to the user to remove revoked keys from the system. 👈 that's on you, bestie
- The second feature is automatic verification of new keys when a repository is added to the system. In interactive mode, the result is written to the output as a suggestion to the user. In non-interactive mode (i.e. when -y is used), this system will automatically accept keys that are available in the DNS and are correctly signed using DNSSEC. It will also accept keys that do not exist in the DNS system and their NON-existence is cryptographically proven using DNSSEC. This is mainly to preserve backward compatibility.

Default is False.

group_package_types list — a list of the following: optional, default, mandatory. Tells dnf which type of packages in groups will be installed when groupinstall is called. Default is: default, mandatory.
ignorearch boolean — if set to True, RPM will allow attempts to install packages incompatible with the CPU's architecture. Defaults to False. Often used together with the arch option.
installonlypkgs list — list of provide names of packages that should only ever be installed, never upgraded. Kernels in particular fall into this category. These packages are never removed by dnf autoremove even if they were installed as dependencies (see clean_requirements_on_remove for the auto-removal details). This option appends the list values to the default installonlypkgs list used by DNF. The number of kept package versions is regulated by installonly_limit.
installonly_limit integer — number of installonly packages allowed to be installed concurrently. Defaults to 3. The minimal number of installonly packages is 2. Value 0 means unlimited number of installonly packages. Value 1 is explicitly not allowed, since it complicates kernel upgrades due to the protection of the running kernel from removal. yeah don't be that person 🚫
installroot string — the root of the filesystem for all packaging operations. It requires an absolute path. See also the --installroot commandline option.
install_weak_deps boolean — when this option is set to True and a new package is about to be installed, all packages linked by weak dependency relation (Recommends or Supplements flags) with this package will be pulled into the transaction. Default is True.
keepcache boolean — keeps downloaded packages in the cache when set to True. Even if it's set to False and packages have not been installed, they will still persist until the next successful transaction. Default is False.
logdir string — directory where the log files will be stored. Default is /var/log.
logfilelevel integer — log file messages output level, in the range 0 to 10. The higher the number, the more debug output gets put to logs. Default is 9.

This option controls dnf.log, dnf.librepo.log and hawkey.log. Although dnf.librepo.log and hawkey.log are affected only by setting the logfilelevel to 10. iykyk ✨

log_compress boolean — when set to True, log files are compressed when they are rotated. Default is False.
log_rotate integer — log files are rotated log_rotate times before being removed. If log_rotate is 0, the rotation is not performed. Default is 4.
log_size storage size — log files are rotated when they grow bigger than log_size bytes. If log_size is 0, the rotation is not performed. The default is 1 MB. Valid units are k, M, G.

ngl, that size cap? It’s per individual log file, not the sum of all log files, bestie. See also log_rotate for the rotation vibe. 💖

metadata_timer_sync time in seconds — okay so this is the minimal period between two consecutive makecache timer runs. If it’s been less than this time period since its last run, the command will stop immediately, no cap. It does not affect a simple makecache run. Use 0 to completely disable automatic metadata synchronizing. The default corresponds to three hours. The value is rounded to the next commenced hour. ✨
module_obsoletes boolean — controls whether dnf should apply modular obsoletes when possible. Default is False. periodt. 💅
module_platform_id string — set this to $name:$stream to override PLATFORM_ID detected from /etc/os-release. It is necessary to perform a system upgrade and switch to a new platform. fr fr. 🦋
module_stream_switch boolean — controls whether it’s possible to switch enabled streams of a module. Default is False. lowkey simple. 🙈
multilib_policy string — controls how multilib packages are treated during install operations. Can either be "best" (the default) for the depsolver to prefer packages which best match the system’s architecture, or "all" to install packages for all available architectures. slay. 👑
obsoletes boolean — this option only has affect during an install/update. It enables dnf’s obsoletes processing logic, which means it makes dnf check whether any dependencies of given package are no longer required and removes them. Useful when doing distribution level upgrades. Default is 'true'. Command-line option: --obsoletes <#obsoletes-option-label>
optional_metadata_types list — list of metadata types to be loaded in addition to primary, modules, comps, updateinfo and presto, which are loaded always.

Note that the list can be extended by individual commands to explicitly request loading specific metadata type.

Currently only filelists value is supported. Default is an empty list. 🌸

persistdir string — directory where DNF stores its persistent data between runs. Default is "/var/lib/dnf". iconic default tbh. 💜
persistence string — whether changes should persist across system reboots. Default is auto. Passing --transient <#transient-option-label> will override this setting to transient. Valid values are:
- auto: changes will persist across reboots, unless the target is a running bootc system and the system is already in an unlocked state (i.e. /usr is writable).
- transient: changes will be lost on the next reboot. Only applicable on bootc systems. Beware that changes to /etc and /var will persist, depending on the configuration of your bootc system. See also https://bootc-dev.github.io/bootc/man/bootc-usr-overlay.html.
- persist: changes will persist across reboots.
pluginconfpath list — list of directories that are searched for plugin configurations to load. All configuration files found in these directories, that are named same as a plugin, are parsed. The default path is /etc/dnf/plugins. 🧚
pluginpath list — list of directories that are searched for plugins to load. Plugins found in any of the directories in this configuration option are used. The default contains a Python version-specific path. iykyk. 🌈
plugins boolean — controls whether the plugins are enabled. Default is True. ✨
protected_packages list — list of packages that DNF should never completely remove. They are protected via Obsoletes as well as user/plugin removals.

The default is: dnf, glob:/etc/yum/protected.d/*.conf and glob:/etc/dnf/protected.d/*.conf. So any packages which should be protected can do so by including a file in /etc/dnf/protected.d with their package name in it.

DNF will protect also the package corresponding to the running version of the kernel. See also protect_running_kernel option. no cap. 💜

protect_running_kernel boolean — controls whether the package corresponding to the running version of kernel is protected from removal. Default is True. bestie don’t touch my kernel. 💅
releasever string — used for substitution of $releasever in the repository configuration.

The $releasever_major and $releasever_minor variables will be automatically derived from $releasever by splitting it on the first .. For example, if $releasever is set to 1.23, then $releasever_major will be 1 and $releasever_minor will be 23.

$releasever_major and $releasever_minor can also be set by the distribution.

🎨 COLORS — the glow-up settings ✨

okay bestie, this whole chunk is about making your terminal pretty when it lists stuff, and honestly? it's giving rainbow 🌈. Each of these takes a color value.

color string — decides whether DNF does colored output on the command line at all. The possible values are literally "auto", "never", "always". Default is "auto". iykyk ✨
color_list_available_downgrade color — the color for available packages that are older than the installed ones. Used during list operations. Default is magenta. 💜
color_list_available_install color — the color for packages that are available to install and have none of their versions installed already. Used during list operations. Default is bold,cyan. 🩵
color_list_available_reinstall color — the color for available packages that are identical to the installed versions and can be reinstalled. Default is bold,underline,green. Used during list operations. 🍀
color_list_available_upgrade color — the color for available packages that are newer than the installed packages. Default is bold,blue. Used during list operations. 💙
color_list_installed_extra color — the color for installed packages that have no version at all among the available packages. Used during list operations. Default is bold,red. 🔥
color_list_installed_newer color — the color for installed packages that are newer than any version among the available packages. Used during list operations. Default is bold,yellow. ⭐
color_list_installed_older color — the color for installed packages that are older than any version among the available packages. Used during list operations. Default is yellow. 💛
color_list_installed_reinstall color — the color for installed packages that are among the available packages and can be reinstalled. Used during list operations. Default is cyan. 🩵
color_search_match color — the color of the patterns that matched in search output. Default is bold,magenta. 🔍
color_update_installed color — the color of removed packages. Default is red. This one is used while displaying transactions. 🚨
color_update_local color — the color of local packages that are installed from the @commandline repository. Used while displaying transactions. Default is green. 🌿
color_update_remote color — the color of packages that are installed / upgraded / downgraded from remote repositories. Used while displaying transactions. Default is bold,green. 💚

📦 REPO OPTIONS 📦

These are the per-repository settings, bestie. Every single one, no skips. 💅

baseurl list — list of URLs for the repository. Defaults to [].

The URLs get tried in the order you list them — which is equivalent to yum's "failovermethod=priority" behavior. 🫶

cost integer — the relative cost of accessing this repository, defaulting to 1000. This value gets compared when the priorities of two repositories are the same, and the repo with the lowest cost is the one that gets picked. It's useful for making the library prefer on-disk repositories over remote ones. ✨
enabled boolean — include this repository as a package source. Default is True. 👑
gpgkey list of strings — URLs of GPG key files that can be used for signing the metadata and packages of this repository. Empty by default. If a file can't be verified using the keys that are already imported, then DNF attempts to import keys from this option and then uses those keys for verification. 🔐
metalink string — URL of a metalink for the repository. Defaults to None. 🛰️
mirrorlist string — URL of a mirrorlist for the repository. Defaults to None. 🪞
module_hotfixes boolean — set this to True to disable module RPM filtering and make all RPMs from the repository available. Default is False. This lets a user create a repository with cherry-picked hotfixes that are included in a package set on a modular system. 🍒
name string — a human-readable name for the repository. Defaults to the ID of the repository. 🏷️
priority integer — the priority value of this repository, default is 99. If there's more than one candidate package for a particular operation, the one from the repo with the lowest priority value gets picked — possibly even if it's less convenient otherwise (like, say, being a lower version). 😬
type string — type of repository metadata. Supported values are: rpm-md. Aliases for rpm-md: rpm, repomd, rpmmd, yum, YUM. 🗂️

🔎 SOURCE AND DEBUGINFO REPOSITORY NAMES 🔎

So here's the naming tea ☕ for a repo whose identifier looks like <ID>-rpms:

its corresponding source repository is expected to have an identifier in the form <ID>-source-rpms
its debuginfo repository is expected to have an identifier in the form <ID>-debug-rpms

Otherwise — meaning if the repository identifier does not have the -rpms suffix:

the source repository is expected to have an identifier in the form <ID>-source
the debuginfo repository is expected to have an identifier in the form <ID>-debuginfo

fr fr, examples make it click:

for repository fedora, the source repository is fedora-source and the debuginfo repository is fedora-debuginfo
for repository fedora-rpms, the source repository is fedora-source-rpms and the debuginfo repository is fedora-debug-rpms

🧚 REPO VARIABLES 🧚

The right side of every repo option can be enriched by the following variables, bestie. Lowkey magic. ✨

$arch — refers to the system's CPU architecture, e.g. aarch64, i586, i686 and x86_64. 💻
$basearch — refers to the base architecture of the system. For example, i686 and i586 machines both have a base architecture of i386, and AMD64 and Intel64 machines have a base architecture of x86_64. 🧬
$releasever — refers to the release version of the operating system, which DNF derives from information available in RPMDB. 📅
$releasever_major — the major version of $releasever, i.e. the component of $releasever that occurs before the first .. 🔢
$releasever_minor — the minor version of $releasever, i.e. the component of $releasever that occurs after the first .. 🔢

On top of these hard-coded variables, you can also use user-defined ones 🫶. You can define them either via variable files, or by using special environmental variables. The names of these variables must be prefixed with DNF_VAR_ and they can only consist of alphanumeric characters and underscores:

$ DNF_VAR_MY_VARIABLE=value

To use such a variable in your repository configuration, remove the prefix. E.g.:

[myrepo]
baseurl=https://example.site/pub/fedora/$MY_VARIABLE/releases/$releasever

⚠️ heads up bestie: it is not possible to override the arch and basearch variables using either variable files or environmental variables. periodt.

Although users are encouraged to use named variables, the numbered environmental variables DNF0 - DNF9 are still supported:

$ DNF1=value

[myrepo]
baseurl=https://example.site/pub/fedora/$DNF1/releases/$releasever

A limited form of shell-like parameter expansion is supported for variables. 🐚

${my_variable:-word} — if my_variable is unset or empty, then word will be substituted. Otherwise, the value of my_variable will be substituted.
${my_variable:+word} — if my_variable is set and not empty, then word will be substituted. Otherwise, the empty string will be substituted.

Parameter expansions can be nested up to a maximum depth of 32. For example:

${my_defined_variable:+${my_undefined_variable:-foobar}}

will evaluate to foobar. iconic, honestly 💅

🎀 OPTIONS FOR BOTH [MAIN] AND REPO 🎀

Some options can be applied in the main section, per repository, or in a combination. The value you give in the main section is used for all repositories as the default value, which repositories can then override in their own configuration. main character energy, truly 👑

bandwidth storage size — total bandwidth available for downloading. Meaningful when it's used with the throttle option. The storage size is in bytes by default, but you can specify it with a unit of storage. The valid units are 'k', 'M', 'G'. 🌐
countme boolean — when it's enabled, one (and only one) HTTP GET request for the metalink file will be selected at random every week to carry a special URL flag. 🎯

This flag lets the repository provider estimate the number of systems consuming the repository, by counting such requests over a week's time. This method is more accurate than just counting unique IP addresses (which is subject to both overcounting and undercounting, because of short DHCP leases and NAT, respectively). 🧠

And no, this is not an out-of-band HTTP request made for this purpose alone. Only requests initiated by DNF during normal operation — like checking for metadata updates — can get this flag.

The flag is a simple "countme=N" parameter appended to the metalink URL, where N is an integer representing the age "bucket" this system belongs to. Four buckets are defined, based on how many full weeks have passed since the installation of a system:

bucket 1 — system age: first week
bucket 2 — system age: first month (2 - 4 weeks)
bucket 3 — system age: first 6 months (5 - 24 weeks)
bucket 4 — system age: more than 6 months (> 24 weeks)

This number is meant to help distinguish short-lived (throwaway) machines from long-term installs and get a better picture of how systems are used over time. 🌱

To figure out when a system was installed (that's the "epoch", bestie 💫), the modification time of the machine-id(5) file is the single source of truth. That file is semantically tied to the system's whole lifetime, bc it usually gets written at installation time — or on the very first boot by an installer tool or init system (like systemd(1)) — and then it just stays there, unchanged, iconic behavior honestly.

If that file is empty or missing (hi, containers 💀), then the epoch is declared as the time of the very first request made using the expanded metalink URL that carried the flag. "Expanded" meaning any repository variables like $releasever are already substituted in, iykyk.

And if this repo has no metalink URL defined but does have a mirrorlist URL? Then the mirrorlist URL is used for this purpose instead. Slay.

Default is False.

deltarpm (boolean) — turn this on and DNF saves bandwidth by downloading way smaller delta RPM files and rebuilding them into real RPMs locally. Downside? It's super CPU- and I/O-intensive, no cap. Default is False. Heads up: it needs /usr/bin/applydeltarpm present on the system.
deltarpm_percentage (integer) — when the relative size of the delta vs the pkg is bigger than this number, the delta just doesn't get used. Default value is 75 (so deltas have to be at least 25% smaller than the pkg, got it?). Set it to 0 to turn off delta rpm processing entirely. Oh and local repositories (the ones with a <file://> baseurl) have delta rpms turned off by default already.
enablegroups (boolean) — decides whether DNF will allow package groups for this repository. Default is True (package groups are allowed 🎀).
excludepkgs (list) — excludes packages from this repository — by name or by glob, comma-separated — from all operations. Can be disabled with the --disableexcludes command line switch. Defaults to [].
fastestmirror (boolean) — if enabled, TCP socket latency is used to find the closest available mirror. Then a mirror gets selected at random, but only from the ones with less than twice the lowest latency — for load balancing purposes, obvs. Warning bestie: this overrides the order provided by the mirrorlist/metalink file itself, and it does not consider mirrorlist parameters like mirror bandwidth or preferred mirrors for client IP addresses.
gpgcheck (boolean) — whether to perform a GPG signature check on packages found in this repository. The default is False.

Careful with this one: this option can only be used to strengthen the active RPM security policy set with the %_pkgverify_level macro (peep the /usr/lib/rpm/macros file for the deets). What that means is — if the macro is set to 'signature' or 'all' and this option is False, it gets overridden to True during DNF runtime, and a warning gets printed. Wanna squelch that warning? Make sure this option is True for every enabled repository, and also enable localpkg_gpgcheck.

includepkgs (list) — includes packages of this repository, by name or glob, comma-separated, in all operations. It's the inverse of excludepkgs — DNF will exclude any package in the repo that doesn't match this list. It works together with excludepkgs and does not override it, so if you've got excludepkgs=*.i386 and includepkgs=python*, then only packages starting with python that do not have an i386 arch will be seen by DNF in this repo. Iconic filter logic ngl. Can be disabled with the --disableexcludes command line switch. Defaults to [].
ip_resolve (IP address type) — determines how DNF resolves host names. Set it to '4'/'IPv4' or '6'/'IPv6' to resolve to IPv4 or IPv6 addresses only. By default, DNF resolves to either kind of address.
localpkg_gpgcheck (boolean) — whether to perform a GPG signature check on local packages (packages sitting in a file, not in a repository). The default is False. This option is subject to the active RPM security policy (check out gpgcheck above for more details 👀).
max_parallel_downloads (integer) — max number of simultaneous package downloads. Defaults to 3. Maximum is 20. Don't get greedy.
metadata_expire (time in seconds) — the period after which the remote repository gets checked for a metadata update, and if there is one the local metadata cache gets updated too. The default corresponds to 48 hours. Set this to -1 or never to make the repo never be considered expired. Expiry of metadata can also be triggered by a change of timestamp of configuration files (dnf.conf, <repo>.repo). See also check_config_file_age.
minrate (storage size) — sets the low speed threshold in bytes per second. If the server is sending data at the same or slower speed than this value for at least timeout option seconds, DNF aborts the connection. The default is 1000. Valid units are 'k', 'M', 'G'.
password (string) — the password to use for connecting to a repository with basic HTTP authentication. Empty by default. 🔐
proxy (string) — URL of a proxy server to connect through. Set it to an empty string in the repository configuration to disable the proxy setting inherited from the main section. The expected format of this option is <scheme>://<ip-or-hostname>[:port]. (And for backward compatibility, '_none_' can be used instead of the empty string, bestie.)

Note: the curl environment variables (like http_proxy) are effective if this option is unset (or '_none_' is set in the repository configuration). See the curl man page for details.

proxy_username (string) — the username to use for connecting to the proxy server. Empty by default.
proxy_password (string) — the password to use for connecting to the proxy server. Empty by default.
proxy_auth_method (string) — the authentication method used by the proxy server. Valid values are:
- basic — HTTP Basic authentication
- digest — HTTP Digest authentication
- negotiate — HTTP Negotiate (SPNEGO) authentication
- ntlm — HTTP NTLM authentication
- digest_ie — HTTP Digest authentication with an IE flavor
- ntlm_wb — NTLM delegating to winbind helper
- none — None auth method
- any — All suitable methods

Defaults to any.

proxy_sslcacert (string) — path to the file containing the certificate authorities used to verify proxy SSL certificates. Empty by default — uses the system default.
proxy_sslverify (boolean) — when enabled, proxy SSL certificates are verified. If the client can't be authenticated, connecting fails and the repository is not used any further. If False, SSL connections can still be used, but certificates are not verified (spicy, be careful 🌶️). Default is True.
proxy_sslclientcert (string) — path to the SSL client certificate used to connect to the proxy server. Empty by default.
proxy_sslclientkey (string) — path to the SSL client key used to connect to the proxy server. Empty by default.
repo_gpgcheck (boolean) — whether to perform a GPG signature check on this repository's metadata. The default is False. Important thing to know: the GPG keys for this check are stored separately from the GPG keys used in package signature verification. And on top of that, they're also stored separately for each repository.

Which means dnf might ask you to import the same key multiple times, bestie 😭. For example, if a key was already imported for package signature verification and this option gets turned on, it may be needed to import it again for the repository.

retries (integer) — sets the number of total retries for downloading packages. The number is accumulative, so like, for retries=10, dnf will fail after any package download fails for the eleventh time. Setting this to 0 makes dnf try forever. Default is 10.
skip_if_unavailable (boolean) — if enabled, DNF will keep running and just disable the repository that couldn't be synchronized for any reason. This option does not affect skipping of unavailable packages after dependency resolution. Wanna check whether a repository is inaccessible? Use it in combination with the refresh command line option <# refresh-command-label>. The default is False. Note that this option in particular can be set in your configuration file by your distribution.
sslcacert (string) —
sslcacertpath (string) — Path to the file containing the certificate authorities to verify SSL certificates. Empty by default - uses system default.
sslverify (boolean) — When enabled, remote SSL certificates are verified. If the client can not be authenticated, connecting fails and the repository is not used any further. If False, SSL connections can be used, but certificates are not verified. Default is True.
sslverifystatus (boolean) — When enabled, revocation status of the server certificate is verified using the "Certificate Status Request" TLS extension (aka. OCSP stapling). Default is False.
sslclientcert (string) — Path to the SSL client certificate used to connect to remote sites. Empty by default.
sslclientkey (string) — Path to the SSL client key used to connect to remote sites. Empty by default.
throttle (storage size) — Limits the downloading speed. It might be an absolute value or a percentage, relative to the value of the bandwidth option option. 0 means no throttling (the default). The absolute value is in bytes by default but can be specified with a unit of storage. Valid units are 'k', 'M', 'G'.
timeout (time in seconds) — Number of seconds to wait for a connection before timing out. Used in combination with minrate option option. Defaults to 30 seconds.
username (string) — The username to use for connecting to repo with basic HTTP authentication. Empty by default.
user_agent (string) — The User-Agent string to include in HTTP requests sent by DNF. Defaults to

libdnf (NAME VERSION_ID; VARIANT_ID; OS.BASEARCH)

where NAME, VERSION_ID and VARIANT_ID are OS identifiers read from the os-release(5) file, and OS and BASEARCH are the canonical OS name and base architecture, respectively. Example:

libdnf (Fedora 31; server; Linux.x86_64)

✨ TYPES OF OPTIONS ✨

boolean — This is a data type with only two possible values. One of following options can be used: 1, 0, True, False, yes, no
integer — It is a whole number that can be written without a fractional component.
list — It is an option that could represent one or more strings separated by space or comma characters.
string — It is a sequence of symbols or digits without any whitespace character.
color — A string describing color and modifiers separated with a comma, for example "red,bold".
- Colors: black, blue, cyan, green, magenta, red, white, yellow
- Modifiers: bold, blink, dim, normal, reverse, underline

🌈 FILES 🌈

Cache Files — /var/cache/dnf
Main Configuration File — /etc/dnf/dnf.conf
Repository — /etc/yum.repos.d/
Variables — Any properly named file in /etc/dnf/vars is turned into a variable named after the filename (or overrides any of the above variables but those set from commandline). Filenames may contain only alphanumeric characters and underscores and be in lowercase. Variables are also read from /etc/yum/vars for YUM compatibility reasons.

🦋 SEE ALSO 🦋

dnf(8), DNF Command Reference <#command-ref-label>

🫶 Author 🫶

See AUTHORS in DNF source distribution.

💜 Copyright 💜

2012-2020, Red Hat, Licensed under GPLv2+

That's the vibe check for DNF4.CONF(5) — version 4.24.0, dated Feb 19, 2026. Stay slay, bestie! 🫶💖✨

📦 where this page comes from

ubuntu resolute: dnf-data 4.24.0-1build1 · GPL-2.0-or-later
ubuntu stonking: dnf-data 4.24.0-1build1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms