YUM.CONF(5)

📦
version 4.23.0 · 5 versions
, in opensuse-leap 16.0

💅 YUM.CONF(5) — the yum.conf glow-up

okay bestie, so here's the thing: this is yum.conf(5), and it is literally just a redirect to the DNF Configuration Reference. That's the whole vibe. The yum of it all still matters though, so let's get into it 💖

✨ NAME ✨

yum.conf — redirecting to DNF Configuration Reference 🎀

🌸 DESCRIPTION 🌸

So DNF, by default, uses the global configuration file at /etc/dnf/dnf.conf, plus all the *.repo files it can find under /etc/yum.repos.d. That second one? That's your repository config spot, and it takes precedence over the global configuration. Periodt. 👑

The configuration file has INI format, meaning it's made of a section declaration plus name=value options under each, each one on its own separate line. There are two types of sections in these files: main and repository.

The main section defines all the global configuration options and there should only be one of it. One. Single. Main character section. ✨

The repository sections define the configuration for each repository (remote or local, doesn't matter). The section name of the repository in brackets serves as the repo ID reference, and it needs to be unique across configuration files. The allowed characters for a repo ID string are lower and upper case alphabetic letters, digits, -, _, . and :. And a minimal repository configuration file should, aside from the repo ID, consist of a baseurl, metalink or mirrorlist option definition. That's the bare minimum, no cap 🫶

🦋 DISTRIBUTION-SPECIFIC CONFIGURATION 🦋

Some configuration options — namely best and skip_if_unavailable — can be set in the DNF configuration file by your distribution to override the DNF defaults. So like, if things look weird, blame your distro, not me 🙈

👑 [MAIN] OPTIONS 👑

okay this is the big one, buckle up bestie, there are so many of these 💀

  • allow_vendor_change — boolean

If disabled, dnf will stick to the vendor when upgrading or downgrading rpms. Default is False.

WARNING: This option is currently not supported for downgrade and distro-sync commands. So like, don't come for me if it doesn't work there 😭
  • arch — string

The architecture used for installing packages. By default this is auto-detected. Often used together with the ignorearch option.

  • assumeno — boolean

If enabled, dnf will assume No where it would normally prompt for confirmation from user input. Default is False.

  • assumeyes — boolean

If enabled, dnf will assume Yes where it would normally prompt for confirmation from user input (see also defaultyes). Default is False.

  • autocheck_running_kernel — boolean

Automatic check whether there is an installed newer kernel module with a security update than the currently running kernel. Default is True.

  • basearch — string

The base architecture used for installing packages. By default this is auto-detected.

  • best — boolean

True instructs the solver to either use a package with the highest available version or fail. On False, do not fail if the latest version cannot be installed and go with the lower version. The default is False.

Note that this option in particular can be set in your configuration file by your distribution. Also note that the use of the highest available version is only guaranteed for the packages directly requested and not for their dependencies. iykyk ✨

  • cachedir — string

Path to a directory used by various DNF subsystems for storing cache data. It has a reasonable root-writable default depending on the distribution. DNF needs to be able to create files and directories at this location, so like, give it the keys to the place 🔑

  • cacheonly — boolean

If set to True, DNF will run entirely from the system cache — it will not update the cache and will use it even in case it is expired. Default is False.

API Notes: Must be set before repository objects are created. Plugins must set this in the pre_config hook. Later changes are ignored. So set it early or don't bother, fr fr.

  • check_config_file_age — boolean

Specifies whether dnf should automatically expire metadata of repos which are older than their corresponding configuration file (usually the dnf.conf file and the foo.repo file). Default is True (perform the check). Expire of metadata is also affected by metadata age. See also metadata_expire.

  • clean_requirements_on_remove — boolean

Remove dependencies that are no longer used during dnf remove. A package only qualifies for removal via clean_requirements_on_remove if it was installed through DNF but not on explicit user request — i.e. it was pulled in as a dependency. The default is True. (installonlypkgs are never automatically removed.) the way it cleans up after itself, iconic 💅

  • config_file_path — string

Path to the default main configuration file. Default is /etc/dnf/dnf.conf.

  • debuglevel — integer

Debug messages output level, in the range 0 to 10. The higher the number, the more debug output is put to stdout. Default is 2.

  • debug_solver — boolean

Controls whether the libsolv debug files should be created when solving the transaction. The debug files are created in the ./debugdata directory. Default is False.

  • defaultyes — boolean

If enabled, the default answer to user confirmation prompts will be Yes. Not to be confused with assumeyes, which will not prompt at all. Default is False. subtle but so different, okay?? 🎀

  • diskspacecheck — boolean

Controls whether rpm should check available disk space during the transaction. Default is True.

  • errorlevel — integer

Error messages output level, in the range 0 to 10. The higher the number, the more error output is put to stderr. Default is 3.

This is deprecated in DNF and overwritten by the --verbose commandline option. so like, it's giving legacy 😭

  • exclude_from_weak — list

Prevent installing packages as weak dependencies (recommends or supplements). The packages can be specified by a name or a glob and separated by a comma. Defaults to [].

  • exclude_from_weak_autodetect — boolean

If enabled, dnf will autodetect unmet weak dependencies (recommends or supplements) of packages installed on the system. Providers of these weak dependencies will not be installed by dnf as weak dependencies any more (they will still be installed if pulled in as a regular dependency). Defaults to true.

  • exit_on_lock — boolean

Should the dnf client exit immediately when something else has the lock. Default is False.

  • gpgkey_dns_verification — boolean

Should the dnf attempt to automatically verify GPG verification keys using the DNS system. This option requires the unbound python module (python3-unbound) to be installed on the client system.

This system has two main features:

  1. Check if any of the already installed keys have been revoked. Automatic removal of the key is not yet available, so it is up to the user to remove revoked keys from the system.
  2. Automatic verification of new keys when a repository is added to the system. In interactive mode, the result is written to the output as a suggestion to the user. In non-interactive mode (i.e. when -y is used), this system will automatically accept keys that are available in the DNS and are correctly signed using DNSSEC. It will also accept keys that do not exist in the DNS system and their NON-existence is cryptographically proven using DNSSEC. This is mainly to preserve backward compatibility.

Default is False. cryptography queen behavior honestly 🔥

  • group_package_types — list

List of the following: optional, default, mandatory. Tells dnf which type of packages in groups will be installed when 'groupinstall' is called. Default is: default, mandatory.

  • ignorearch — boolean

If set to True, RPM will allow attempts to install packages incompatible with the CPU's architecture. Defaults to False. Often used together with the arch option.

  • installonlypkgs — list

List of provide names of packages that should only ever be installed, never upgraded. Kernels in particular fall into this category. These packages are never removed by dnf autoremove even if they were installed as dependencies (see clean_requirements_on_remove for auto removal details). This option appends the list values to the default installonlypkgs list used by DNF. The number of kept package versions is regulated by installonly_limit.

  • installonly_limit — integer

Number of installonly packages allowed to be installed concurrently. Defaults to 3. The minimal number of installonly packages is 2. Value 0 means unlimited number of installonly packages. Value 1 is explicitly not allowed, since it complicates kernel upgrades due to protection of the running kernel from removal. so 1 is not like other numbers, she's banned 💀

  • installroot — string

The root of the filesystem for all packaging operations. It requires an absolute path. See also --installroot commandline option.

  • install_weak_deps — boolean

When this option is set to True and a new package is about to be installed, all packages linked by weak dependency relation (Recommends or Supplements flags) with this package will be pulled into the transaction. Default is True.

  • keepcache — boolean

Keeps downloaded packages in the cache when set to True. Even if it is set to False and packages have not been installed, they will still persist until the next successful transaction. The default is False. she's holding on to the memories 🥺

  • logdir — string

Directory where the log files will be stored. Default is /var/log.

  • logfilelevel — integer

Log file messages output level, in the range 0 to 10. The higher the number, the more debug output is put to logs. Default is 9.

This option controls dnf.log, dnf.librepo.log and hawkey.log. Although dnf.librepo.log and hawkey.log are affected only by setting the logfilelevel to 10.

  • log_compress — boolean

When set to True, log files are compressed when they are rotated. Default is False.

  • log_rotate — integer

Log files are rotated log_rotate times before being removed. If log_rotate is 0, the rotation is not performed. Default is 4.

  • log_size — storage size

Log files are rotated when they grow bigger than log_size bytes. If log_size is 0, the rotation is not performed. The default is 1 MB. Valid units are 'k', 'M', 'G'.

The size applies for individual log files, not the sum of all log files. See also log_rotate.

...bestie this is only part one, there's more coming 🌈

  • metadata_timer_sync — time in seconds ⏱️

This is the minimum gap between two makecache timer runs back-to-back, bestie. If it's been less than this much time since the last run, the command just stops immediately — like, no thanks, not yet. Important: this does not affect a simple makecache run. Set it to 0 to completely disable automatic metadata synchronizing. Default corresponds to three hours. And the value gets rounded up to the next commenced hour, so don't come for it about precision.

  • module_obsoletes — boolean

Controls whether dnf should apply modular obsoletes when it's possible to. Default is False. Simple as.

  • module_platform_id — string

Set this to $name:$stream to override the PLATFORM_ID that gets detected from /etc/os-release. You need this to perform a system upgrade and switch to a new platform. It's giving "identity crisis but make it config". 💅

  • module_stream_switch — boolean

Controls whether it's possible to switch enabled streams of a module. Default is False. That's the whole thing. 🦋

  • multilib_policy — string

Controls how multilib packages get treated during install operations. Two moods:

  • "best" — the default — tells the depsolver to prefer packages that best match the system's architecture.
  • "all" — installs packages for all available architectures. yes, all of them. 😭
  • obsoletes — boolean

This one only has an effect during an install/update. It enables dnf's obsoletes processing logic, which means dnf checks whether any dependencies of a given package are no longer required and removes them. Super useful when you're doing distribution level upgrades. Default is 'true'.

Command-line option: --obsoletes

  • optional_metadata_types — list

A list of metadata types to be loaded in addition to primary, modules, comps, updateinfo and presto, which are loaded always, no discussion. 🎀

Note that individual commands can extend this list to explicitly request loading a specific metadata type.

Currently only the filelists value is supported. Default is an empty list.

  • persistdir — string

The directory where DNF stores its persistent data between runs. Default is "/usr/lib/sysimage/dnf". It's the memory-keeping icon. 👑

  • persistence — string

Whether changes should persist across system reboots. Default is auto. Passing --transient overrides this setting to transient. Valid values are:

  • auto: changes will persist across reboots — unless the target is a running bootc system and the system is already in an unlocked state (i.e. /usr is writable).
  • transient: changes will be lost on the next reboot. Only applicable on bootc systems. ⚠️ Beware that changes to /etc and /var will persist, depending on the configuration of your bootc system. See also https://containers.github.io/bootc/man/bootc-usr-overlay.html.
  • persist: changes will persist across reboots.
  • pluginconfpath — list

A list of directories that get searched for plugin configurations to load. All configuration files found in these directories that are named the same as a plugin get parsed. Default path is /etc/dnf/plugins. 🔍

  • pluginpath — list

A list of directories searched for plugins to load. Plugins found in any of the directories in this configuration option get used. The default contains a Python version-specific path.

  • plugins — boolean

Controls whether plugins are enabled. Default is True. The plugins stay winning.

  • protected_packages — list

A list of packages that DNF should never completely remove. They're protected via Obsoletes as well as user/plugin removals. Like, hands off. 🙅‍♀️

The default is: dnf, glob:/etc/yum/protected.d/*.conf and glob:/etc/dnf/protected.d/*.conf. So any packages that should be protected can do so by including a file in /etc/dnf/protected.d with their package name in it.

DNF will also protect the package corresponding to the running version of the kernel. See also the protect_running_kernel option.

  • protect_running_kernel — boolean

Controls whether the package corresponding to the running version of the kernel is protected from removal. Default is True. Protect the king. 👑

  • releasever — string

Used for substitution of $releasever in the repository configuration.

The $releasever_major and $releasever_minor variables get automatically derived from $releasever by splitting it on the first .. For example, if $releasever is set to 1.23, then $releasever_major will be 1 and $releasever_minor will be 23. math ate, honestly. ✨

$releasever_major and $releasever_minor can also be set by the distribution.

See also repo variables.

  • reposdir — list

DNF searches for repository configuration files in the paths specified by reposdir. Heads up: the behavior of reposdir could differ when it's used along with the --installroot option. 🫶

  • rpmverbosity — string

RPM debug scriptlet output level. Pick one of: critical, emergency, error, warn, info or debug. Default is info.

  • strict — boolean

Hmm okay so if this is disabled, all unavailable packages or packages with broken dependencies given to the DNF command get skipped without raising the error that would cause the whole operation to fail. Currently this works for the install command only. The default is True. 💀

  • tsflags — list

A list of strings adding extra flags for the RPM transaction. Here's the whole mapping, no cap:

  • noscripts → RPMTRANS_FLAG_NOSCRIPTS
  • test → RPMTRANS_FLAG_TEST
  • notriggers → RPMTRANS_FLAG_NOTRIGGERS
  • nodocs → RPMTRANS_FLAG_NODOCS
  • justdb → RPMTRANS_FLAG_JUSTDB
  • nocontexts → RPMTRANS_FLAG_NOCONTEXTS
  • nocaps → RPMTRANS_FLAG_NOCAPS
  • nocrypto → RPMTRANS_FLAG_NOFILEDIGEST
  • deploops → RPMTRANS_FLAG_DEPLOOPS

Now the important bits, bestie, don't skim: the nocrypto option will also set the _RPMVSF_NOSIGNATURES and _RPMVSF_NODIGESTS VS flags. The test option provides a transaction check without performing the transaction — it includes downloading of packages, gpg keys check (including permanent import of additional keys if necessary), and rpm check to prevent file conflicts. The nocaps is supported with rpm-4.14 or later. When nocaps is used but rpm doesn't support it, DNF only reports it as an invalid tsflag. 🙈

  • upgrade_group_objects_upgrade — boolean

Set this to False to disable the automatic running of group upgrade when running the upgrade command. Default is True (perform the operation). slay, it does the thing by default. 💅

  • varsdir — list

A list of directories where variable definition files get looked for. Defaults to "/etc/dnf/vars", "/etc/yum/vars". See variable files in Configuration reference. 🗂️

  • zchunk — boolean

Enables or disables the use of repository metadata compressed using the zchunk format (if it's available, anyway). Default is True. 🧚

🎨 [MAIN] OPTIONS — COLORS 🎨

Okay bestie, this whole block is about making your terminal output look cute (or not, your call). Every one of these takes a color value unless it says otherwise, and they all do their thing during list operations unless noted. Ready? Slay.

  • color string — the big switch: does DNF even use colored output on the command line? Possible values are "auto", "never", "always". Default is "auto". 💅
  • color_list_available_downgrade color — the color for available packages that are older than what you've got installed. Used during list operations. Default is magenta.
  • color_list_available_install color — the color for packages that are available to install where none of their versions are installed. Used during list operations. Default is bold,cyan.
  • color_list_available_reinstall color — the color for available packages that are identical to your installed versions and are available for reinstalls. Default is bold,underline,green. Used during list operations.
  • color_list_available_upgrade color — the color for available packages that are newer than your installed ones. Default is bold,blue. Used during list operations.
  • color_list_installed_extra color — the color for installed packages that have no version at all among the available packages. Used during list operations. Default is bold,red. 😭
  • color_list_installed_newer color — the color for installed packages that are newer than any version among the available packages. Used during list operations. Default is bold,yellow.
  • color_list_installed_older color — the color for installed packages that are older than any version among the available packages. Used during list operations. Default is yellow.
  • color_list_installed_reinstall color — the color for installed packages that show up among the available packages and can be reinstalled. Used during list operations. Default is cyan.
  • color_search_match color — the color of the patterns that get matched in search output. Default is bold,magenta. ✨
  • color_update_installed color — the color of removed packages. Default is red. This one's used while displaying transactions.
  • color_update_local color — the color of local packages installed from the @commandline repository. Used while displaying transactions. Default is green.
  • color_update_remote color — the color of packages being installed/upgraded/downgraded from remote repositories. Used while displaying transactions. Default is bold,green.

📦 REPO OPTIONS 📦

These are the per-repo settings, i.e. the ones you sprinkle into a [repo] block. Iconic behavior only.

  • baseurl list — the list of URLs for the repository. Defaults to [].

URLs get tried in the order you listed them (equivalent to yum's failovermethod=priority behaviour). 🫶

  • cost integer — the relative cost of accessing this repository, defaulting to 1000. This value is compared when the priorities of two repositories are the same, and the repository with the lowest cost gets picked. Super useful for making the library prefer on-disk repositories over remote ones.
  • enabled boolean — include this repository as a package source. The default is True.
  • gpgkey list of strings — URLs of GPG key files that can be used for signing metadata and packages of this repository, empty by default. If a file can't be verified using the already imported keys, DNF attempts to import keys from this option and those keys are then used for verification. 🔐
  • metalink string — URL of a metalink for the repository. Defaults to None.
  • mirrorlist string — URL of a mirrorlist for the repository. Defaults to None.
  • module_hotfixes boolean — set this to True to disable module RPM filtering and make all RPMs from the repository available. The default is False. This lets you create a repository with cherry-picked hotfixes that are included in a package set on a modular system. 🍒
  • name string — a human-readable name for the repository. Defaults to the ID of the repository.
  • priority integer — the priority value of this repository, default is 99. If there's more than one candidate package for a particular operation, the one from a repo with the lowest priority value gets picked — possibly even if it's less convenient otherwise (like, say, being a lower version). 👀
  • type string — type of repository metadata. Supported values are: rpm-md. Aliases for rpm-md: rpm, repomd, rpmmd, yum, YUM.

🧚 SOURCE AND DEBUGINFO REPOSITORY NAMES 🧚

So here's the naming tea, bestie. For a given repository with an identifier in the form "<ID>-rpms", its corresponding source repository is expected to have an identifier in the form "<ID>-source-rpms" and its debuginfo repository an identifier in the form "<ID>-debug-rpms".

Otherwise — meaning if the repository identifier doesn't have the "-rpms" suffix — the source repository is expected to have an identifier in the form "<ID>-source" and the debuginfo repository an identifier in the form "<ID>-debuginfo".

For example, for repository "fedora", the source repository is "fedora-source" and the debuginfo repository is "fedora-debuginfo". For repository "fedora-rpms", the source repository is "fedora-source-rpms" and the debuginfo repository is "fedora-debug-rpms". See the pattern? Periodt. 🦋

🌈 REPO VARIABLES 🌈

The right side of every repo option can be enriched by the following variables — think of them as little magic placeholders that get filled in for you:

  • $arch — refers to the system's CPU architecture, e.g, aarch64, i586, i686 and x86_64.
  • $basearch — refers to the base architecture of the system. For example, i686 and i586 machines both have a base architecture of i386, and AMD64 and Intel64 machines have a base architecture of x86_64.
  • $releasever — refers to the release version of the operating system, which DNF derives from information available in RPMDB.
  • $releasever_major — major version of $releasever, i.e. the component of $releasever occurring before the first ..
  • $releasever_minor — minor version of $releasever, i.e. the component of $releasever occurring after the first ..

In addition to these hard coded variables, user-defined ones can also be used — no gatekeeping here. They can be defined either via variable files, or by using special environmental variables. The names of these variables must be prefixed with DNF_VAR_ and they can only consist of alphanumeric characters and underscores:

$ DNF_VAR_MY_VARIABLE=value

To use such a variable in your repository configuration, remove the prefix. E.g.:

[myrepo]
baseurl=https://example.site/pub/fedora/$MY_VARIABLE/releases/$releasever
⚠️ Note that it is not possible to override the arch and basearch variables using either variable files or environmental variables. Sorry bestie, those two are off-limits.

Although users are encouraged to use named variables, the numbered environmental variables DNF0 - DNF9 are still supported:

$ DNF1=value

[myrepo]
baseurl=https://example.site/pub/fedora/$DNF1/releases/$releasever

A limited form of shell-like parameter expansion is supported for variables. 👑

  • ${my_variable:-word} — if my_variable is unset or empty, then word will be substituted. Otherwise, the value of my_variable will be substituted.
  • ${my_variable:+word} — if my_variable is set and not empty, then word will be substituted. Otherwise, the empty string will be substituted.

Parameter expansions can be nested up to a maximum depth of 32. For example:

${my_defined_variable:+${my_undefined_variable:-foobar}}

will evaluate to foobar. Nested expansion ate, honestly. 💜

🫶 OPTIONS FOR BOTH [MAIN] AND REPO 🫶

Some options can be applied in either the main section, per repository, or in a combination — the multitaskers of the config file. The value provided in the main section is used for all repositories as the default value, which repositories can then override in their own configuration. Main character energy for [main], basically.

  • bandwidth storage size — total bandwidth available for downloading. Meaningful when used with the throttle option. Storage size is in bytes by default but can be specified with a unit of storage. Valid units are 'k', 'M', 'G'.
  • countme boolean — when enabled, one (and only one) HTTP GET request for the metalink file will be selected at random every week to carry a special URL flag.

This flag allows the repository provider to estimate the number of systems consuming the repository, by counting such requests over a week's time. This method is more accurate than just counting unique IP addresses (which is subject to both overcounting and undercounting due to short DHCP leases and NAT, respectively).

This is not an out-of-band HTTP request made for this purpose alone. Only requests initiated by DNF during normal operation — like checking for metadata updates — can get this flag.

The flag is a simple "countme=N" parameter appended to the metalink URL, where N is an integer representing the age "bucket" this system belongs to. Four buckets are defined, based on how many full weeks have passed since the installation of a system:

  • bucket 1 — first week
  • bucket 2 — first month (2 - 4 weeks)
  • bucket 3 — first 6 months (5 - 24 weeks)
  • bucket 4 — more than 6 months (> 24 weeks)

This number is meant to help distinguish short-lived (throwaway) machines from long-term installs and get a better picture of how systems are used over time. 🕵️‍♀️

the epoch thing — so how do we even know when the system got installed? 💅 We read the modification time of the machine-id(5) file, and that's our single source of truth. Periodt. That file is semantically tied to the system's lifetime, because it's typically populated at installation time or during the first boot by an installer tool or init system (such as systemd(1)), respectively — and then it just stays unchanged forever.

But what if the file is empty or missing (hi, containers 👋)? Then the epoch is declared as the time of the very first request made using the expanded metalink URL — like, with any repository variables such as $releasever substituted — that carried the flag.

And if there's no metalink URL defined for this repository but there is a mirrorlist URL? Then the mirrorlist URL is used for this purpose instead. Slay.

Default is False.

🌸 deltarpm — boolean

Turn this on and DNF saves bandwidth by downloading much smaller delta RPM files and rebuilding them to RPM locally. The catch? It's quite CPU and I/O intensive, ngl. Default is False. Oh, and it requires /usr/bin/applydeltarpm on the system — no binary, no deltas, bestie.

🎀 deltarpm_percentage — integer

If the relative size of delta vs pkg is larger than this number, the delta simply isn't used. Default value is 75 (meaning deltas must be at least 25% smaller than the pkg). Use 0 to turn off delta rpm processing entirely. And heads up: local repositories (with file:// baseurl) have delta rpms turned off by default.

🦋 enablegroups — boolean

Determines whether DNF will allow the use of package groups for this repository. Default is True (package groups are allowed) 💖.

⭐ excludepkgs — list

Excludes packages of this repository — specified by a name or a glob, separated by a comma — from all operations. You can disable it using the --disableexcludes command line switch. Defaults to [].

🔥 fastestmirror — boolean

If enabled, TCP socket latency is used to find the closest available mirror. Then a mirror is selected at random with less than twice the lowest latency, for load balancing purposes. This overrides the order provided by the mirrorlist/metalink file itself, and it does not take into consideration mirrorlist parameters such as mirror bandwidth nor preferred mirrors for client IP addresses. So it's giving "I trust the ping, not the list."

👑 gpgcheck — boolean

Whether to perform GPG signature check on packages found in this repository. The default is False.

Lowkey important: this option can only be used to strengthen the active RPM security policy set with the %_pkgverify_level macro (see the /usr/lib/rpm/macros file for details). That means if the macro is set to 'signature' or 'all' and this option is False, it will be overridden to True during DNF runtime, and a warning will be printed. To squelch the warning, make sure this option is True for every enabled repository, and also enable localpkg_gpgcheck.

🌈 includepkgs — list

Includes packages of this repository — specified by a name or a glob, separated by a comma — in all operations. It's the inverse of excludepkgs: DNF will exclude any package in the repository that doesn't match this list. And it works in conjunction with excludepkgs and does not override it, so if you've got excludepkgs=*.i386 and includepkgs=python* then only packages starting with python that do not have an i386 arch will be seen by DNF in this repo. Can be disabled using the --disableexcludes command line switch. Defaults to [].

💜 ip_resolve — IP address type

Determines how DNF resolves host names. Set this to '4'/'IPv4' or '6'/'IPv6' to resolve to IPv4 or IPv6 addresses only. By default, DNF resolves to either addresses.

💀 localpkg_gpgcheck — boolean

Whether to perform a GPG signature check on local packages (packages in a file, not in a repository). The default is False. This option is subject to the active RPM security policy — see gpgcheck for more details, iykyk.

🍓 max_parallel_downloads — integer

Maximum number of simultaneous package downloads. Defaults to 3. Maximum of 20. Don't be greedy 🫶.

🧚 metadata_expire — time in seconds

The period after which the remote repository is checked for a metadata update, and in the positive case the local metadata cache is updated. The default corresponds to 48 hours. Set this to -1 or never to make the repo never considered expired. Expire of metadata can also be triggered by a change of timestamp of configuration files (dnf.conf, <repo>.repo). See also check_config_file_age.

🌸 minrate — storage size

This sets the low speed threshold in bytes per second. If the server is sending data at the same or slower speed than this value for at least timeout option seconds, DNF aborts the connection. The default is 1000. Valid units are 'k', 'M', 'G'.

🎀 password — string

The password to use for connecting to a repository with basic HTTP authentication. Empty by default.

✨ proxy — string

URL of a proxy server to connect through. Set it to an empty string in the repository configuration to disable a proxy setting inherited from the main section. The expected format of this option is <scheme>://<ip-or-hostname>[:port]. (For backward compatibility, '_none_' can be used instead of the empty string.)

Note: the curl environment variables (such as http_proxy) are effective if this option is unset (or '_none_' is set in the repository configuration). See the curl man page for details.

🦋 proxy_username — string

The username to use for connecting to the proxy server. Empty by default.

🦋 proxy_password — string

The password to use for connecting to the proxy server. Empty by default.

🔥 proxy_auth_method — string

The authentication method used by the proxy server. Valid values are:

  • basic — HTTP Basic authentication
  • digest — HTTP Digest authentication
  • negotiate — HTTP Negotiate (SPNEGO) authentication
  • ntlm — HTTP NTLM authentication
  • digest_ie — HTTP Digest authentication with an IE flavor
  • ntlm_wb — NTLM delegating to winbind helper
  • none — None auth method
  • any — All suitable methods

Defaults to any.

💖 proxy_sslcacert — string

Path to the file containing the certificate authorities to verify proxy SSL certificates. Empty by default — uses system default.

⭐ proxy_sslverify — boolean

When enabled, proxy SSL certificates are verified. If the client can not be authenticated, connecting fails and the repository is not used any further. If False, SSL connections can be used, but certificates are not verified. Default is True.

Fr fr, leaving this off is a vibe check you might fail later 👀 certificates exist for a reason.

🌈 proxy_sslclientcert — string

Path to the SSL client certificate used to connect to proxy server. Empty by default.

🌈 proxy_sslclientkey — string

Path to the SSL client key used to connect to proxy server. Empty by default.

👑 repo_gpgcheck — boolean

Whether to perform GPG signature check on this repository's metadata. The default is False. Note that GPG keys for this check are stored separately from GPG keys used in package signature verification. Furthermore, they are also stored separately for each repository.

Which means dnf may ask to import the same key multiple times 😭. For example, when a key was already imported for package signature verification and this option is turned on, it may be needed to import it again for the repository.

🔥 retries — integer

Set the number of total retries for downloading packages. The number is accumulative, so e.g. for retries=10, dnf will fail after any package download fails for the eleventh time. Setting this to 0 makes dnf try forever — icon behaviour, tbh, it's giving main character energy. Default is 10.

🌸 skip_if_unavailable — boolean

If enabled, DNF will continue running and disable the repository that couldn't be synchronized for any reason. This option doesn't affect skipping of unavailable packages after dependency resolution. To check inaccessibility of a repository, use it in combination with the refresh command line option. The default is False. Note this option in particular can be set in your configuration file by your distribution.

🧚 sslcacert — string

Path to the file containing the certificate authorities to verify SSL certificates. Empty by default — uses system default.

  • sslverify — boolean. When it’s enabled, remote SSL certificates get verified. If the client can not be authenticated, connecting fails and the repository is not used any further. If False, SSL connections can be used, but certificates are not verified. Default is True. 💅 trust but verify, bestie
  • sslverifystatus — boolean. When enabled, revocation status of the server certificate is verified using the Certificate Status Request TLS extension (aka. OCSP stapling). Default is False. ✨ extra security vibes ✨
  • sslclientcert — string. Path to the SSL client certificate used to connect to remote sites. Empty by default.
  • sslclientkey — string. Path to the SSL client key used to connect to remote sites. Empty by default.
  • throttle — storage size. Limits the downloading speed. It might be an absolute value or a percentage, relative to the value of the bandwidth option option. 0 means no throttling (the default). The absolute value is in bytes by default but can be specified with a unit of storage. Valid units are 'k', 'M', 'G'. 🏎️ zoom zoom, but make it controlled
  • timeout — time in seconds. Number of seconds to wait for a connection before timing out. Used in combination with minrate option option. Defaults to 30 seconds.
  • username — string. The username to use for connecting to repo with basic HTTP authentication. Empty by default.
  • user_agent — string. The User-Agent string to include in HTTP requests sent by DNF. Defaults to
libdnf (NAME VERSION_ID; VARIANT_ID; OS.BASEARCH)

where NAME, VERSION_ID and VARIANT_ID are OS identifiers read from the os-release(5) file, and OS and BASEARCH are the canonical OS name and base architecture, respectively. Example:

libdnf (Fedora 31; server; Linux.x86_64)

✨ TYPES OF OPTIONS ✨

  • boolean — This is a data type with only two possible values.

One of following options can be used: 1, 0, True, False, yes, no.

  • integer — It is a whole number that can be written without a fractional component. no decimals allowed, periodt
  • list — It is an option that could represent one or more strings separated by space or comma characters.
  • string — It is a sequence of symbols or digits without any whitespace character.
  • color — A string describing color and modifiers separated with a comma, for example "red,bold".
    • Colors: black, blue, cyan, green, magenta, red, white, yellow
    • Modifiers: bold, blink, dim, normal, reverse, underline

🎀 FILES 🎀

📦 Cache Files

/var/cache/dnf

⚙️ Main Configuration File

/etc/dnf/dnf.conf

🗂️ Repository

/etc/yum.repos.d/

🧚 Variables

Any properly named file in /etc/dnf/vars is turned into a variable named after the filename (or overrides any of the above variables but those set from commandline). Filenames may contain only alphanumeric characters and underscores and be in lowercase. Variables are also read from /etc/yum/vars for YUM compatibility reasons. iykyk, the vars folder is lowkey iconic

👀 SEE ALSO 👀

  • dnf(8), DNF Command Reference

👑 AUTHOR 👑

See AUTHORS in DNF source distribution.

2012-2020, Red Hat, Licensed under GPLv2+

💖 okay bestie, this page is from source/version 4.23.0, dated Mar 19, 2025 — page YUM.CONF(5). go forth and config slay ✨🦋

📦 where this page comes from