Suggested yum repository changes

[CounterPillow]

General

1. Force all repository data to be fetched over HTTPS. especially the metadata.
2. Add signing key to some location that is only accessible over HTTPS
3. Tell users to install the pygpgme package if they wish to have yum verify signatures (it doesn't by default?!?!) (Note: As far as I can tell, EPEL isn't required for pygpgme, but I didn't try. That entire site may be bullshit.)

.repo file

1. Set gpgcheck=1
2. Set repo_gpgcheck=1
3. Set gpgkey=https://overviewer.org/location/of/our/public/signing/key
4. Inform people of this change. It is not breaking since the .repo file is used locally, but people may wish to use signatures.

misc primary.xml

1. Change <rpm:vendor> from Andrew Brown <[email protected]> to something less broken and more relevant.
2. Change <url> from http://overviewer.org to https://overviewer.org

repomd.xml

1. After createrepo, do gpg --detach-sign --armor repodata/repomd.xml. yum will automatically fetch the created repodata/repomd.xml.asc.

Sources

1. https://blog.packagecloud.io/eng/2014/11/24/howto-gpg-sign-verify-rpm-packages-yum-repositories/
2. https://access.redhat.com/blogs/766093/posts/1976693