Packages on Rocky Linux and RHEL: dnf, rpm and repositories

Everything runs on rocky01 as student with sudo. Steps 1 to 3 only read; the rest install and remove a few small packages (tmux, htop, epel-release) and add one repo file. Rocky outputs below are examples from our lab VM: your versions, transaction IDs and timings will differ, the shape won’t.

1See which dnf you have and where its settings live

Run this:

dnf --version | head -n 1
ls /etc/yum.repos.d/
grep -v '^#' /etc/dnf/dnf.conf

You should see something like this:

4.20.0
rocky-addons.repo  rocky-devel.repo  rocky-extras.repo  rocky.repo
[main]
gpgcheck=1
installonly_limit=3
clean_requirements_on_remove=True
best=True
skip_if_unavailable=False

4.20.0 is DNF 4. The four .repo files come from the rocky-repos package (the exact list can change between point releases). In dnf.conf, best=True means “the newest version or an error”, and skip_if_unavailable=False means one broken repo stops every dnf command, which you’ll see in the Break-It part.

✅ Checkpoint: dnf prints a 4.x version and you can name the file that holds the global options.

2Read the repo list and one repo definition

Run this:

dnf repolist
sed -n '/^\[baseos\]/,/^$/p' /etc/yum.repos.d/rocky.repo

You should see something like this:

repo id                       repo name
appstream                     Rocky Linux 10 - AppStream
baseos                        Rocky Linux 10 - BaseOS
extras                        Rocky Linux 10 - Extras
[baseos]
name=Rocky Linux $releasever - BaseOS
mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=BaseOS-$releasever$rltype
#baseurl=http://dl.rockylinux.org/$contentdir/$releasever/BaseOS/$basearch/os/
gpgcheck=1
enabled=1
countme=1
metadata_expire=6h
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10

repolist shows enabled repos only; add --all to see crb, devel and the debug and source repos too. The baseos section uses a mirrorlist, and the commented baseurl is the fallback you can switch to if the mirror service is ever blocked by your proxy. The gpgkey path is the Rocky 10 release key that every package must be signed with.

✅ Checkpoint: You can point at the repo id, the mirrorlist, gpgcheck and gpgkey lines of baseos.

3Search before you install

Run this:

dnf info tmux
dnf provides /usr/bin/dig

You should see something like this:

Last metadata expiration check: 0:14:02 ago on Tue 27 Oct 2026 10:48:11 AM IST.
Available Packages
Name         : tmux
Version      : 3.3a
Release      : 13.20230918gitb202a2f.el10
Architecture : x86_64
Size         : 476 k
Source       : tmux-3.3a-13.20230918gitb202a2f.el10.src.rpm
Repository   : baseos
Summary      : A terminal multiplexer
URL          : https://tmux.github.io/
bind-utils-32:9.18.33-4.el10.x86_64 : Utilities for querying DNS name servers
Repo        : appstream
Matched from:
Filename    : /usr/bin/dig

dnf info shows the version and repo before you commit to anything. dnf provides answers the everyday question “which package gives me this command or file?”, even for packages that aren’t installed. Use '*/dig' with quotes when you don’t know the full path.

✅ Checkpoint: You know tmux comes from baseos and dig comes from bind-utils.

4Install a package, then ask rpm about it

Run this:

sudo dnf install -y tmux

You should see something like this:

Last metadata expiration check: 0:15:40 ago on Tue 27 Oct 2026 10:48:11 AM IST.
Dependencies resolved.
================================================================================
 Package     Architecture  Version                           Repository    Size
================================================================================
Installing:
 tmux        x86_64        3.3a-13.20230918gitb202a2f.el10        baseos       476 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 476 k
Installed size: 1.1 M
Downloading Packages:
tmux-3.3a-13.20230918gitb202a2f.el10.x86_64.rpm  2.1 MB/s | 476 kB     00:00
--------------------------------------------------------------------------------
Total                                           1.2 MB/s | 476 kB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1
  Installing       : tmux-3.3a-13.20230918gitb202a2f.el10.x86_64                 1/1
  Running scriptlet: tmux-3.3a-13.20230918gitb202a2f.el10.x86_64                 1/1
  Verifying        : tmux-3.3a-13.20230918gitb202a2f.el10.x86_64                 1/1

Installed:
  tmux-3.3a-13.20230918gitb202a2f.el10.x86_64

Complete!

Now query the rpm database:

rpm -q tmux
rpm -qi tmux | grep -E '^(Name|Version|Release|Signature|Vendor|Summary)'
rpm -ql tmux | head -n 4
rpm -qf /usr/bin/tmux /etc/ssh/sshd_config

You should see something like this:

tmux-3.3a-13.20230918gitb202a2f.el10.x86_64
Name        : tmux
Version     : 3.3a
Release     : 13.20230918gitb202a2f.el10
Signature   : RSA/SHA256, Thu 06 Nov 2025 01:12:44 PM IST, Key ID 5b106c736fedfc85
Vendor      : Rocky Enterprise Software Foundation
Summary     : A terminal multiplexer
/usr/bin/tmux
/usr/share/doc/tmux
/usr/share/doc/tmux/CHANGES
/usr/share/doc/tmux/README
tmux-3.3a-13.20230918gitb202a2f.el10.x86_64
openssh-server-9.9p1-11.el10_2.x86_64

-q says whether it’s installed, -qi gives details including which key signed it (the Key ID ends in 6fedfc85, the Rocky 10 key), -ql lists its files and -qf tells you which package owns a file. That last one is how you find out where a strange config file came from. rpm -q kernel lists every installed kernel the same way:

rpm -q kernel

kernel-6.12.0-211.16.1.el10_2.0.1.x86_64

Try it yourself: build the install-and-check commands for dnf or apt in the Command Builder.

✅ Checkpoint: rpm -q tmux prints a full name-version-release and rpm -qf /usr/bin/tmux names the tmux package.

5Verify installed files with rpm -V

Change a file mode on purpose, then verify:

rpm -V tmux; echo "exit=$?"
sudo chmod 700 /usr/bin/tmux
rpm -V tmux

You should see this:

exit=0
.M.......    /usr/bin/tmux

No output means every file matches the size, digest, mode, owner and timestamp recorded at install. In the changed line each position is one test: S size, M mode, 5 digest, D device, L link, U user, G group, T time, P capabilities, and a dot means “same”. A c before the path marks a config file, where changes are normal.

Put the mode back from the database:

sudo rpm --setperms tmux
rpm -V tmux; echo "exit=$?"

exit=0

✅ Checkpoint: rpm -V shows .M……. after the chmod and nothing after rpm --setperms.

6Check GPG keys and a package signature

Run this:

rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
cd /tmp && dnf download tmux
rpm -K tmux-*.rpm

You should see something like this:

gpg-pubkey-6fedfc85-682b3e10	Release Engineering (Rocky Linux 10) <releng@rockylinux.org> public key
tmux-3.3a-13.20230918gitb202a2f.el10.x86_64.rpm: digests signatures OK

Imported keys live in the rpm database as fake packages named gpg-pubkey-KEYID-DATE. The Rocky 10 key ID 6fedfc85 matches the fingerprint published on rockylinux.org/keys (FC22 6859 … 6FED FC85), which is how you check a key before trusting it. rpm -K checks a downloaded file’s digests and signature without installing it, useful for vendor RPMs that arrive by email or USB. Remove the file afterwards with rm /tmp/tmux-*.rpm.

✅ Checkpoint: rpm -K prints “digests signatures OK” for the tmux file.

7Look back with dnf history, then undo

Run this:

sudo dnf history list | head -n 5
sudo dnf history info last

You should see something like this:

ID     | Command line              | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
     6 | install -y tmux           | 2026-10-27 11:04 | Install        |    1
     5 | install -y lsof nmap-ncat | 2026-10-21 15:12 | Install        |    2
     4 | install -y efibootmgr     | 2026-10-19 10:31 | Install        |    1
Transaction ID : 6
Begin time     : Tue 27 Oct 2026 11:04:19 AM IST
Begin rpmdb    : 6c1f4e0a9b27d3c58e41a7f2b90d6e13c4a85f7d2e9b01c36a4d8f5e7b2c9a10
End time       : Tue 27 Oct 2026 11:04:20 AM IST (1 seconds)
End rpmdb      : 0e9d3b71c5a24f86d1b3e07a95c2f48e6a1d7b39c0f52e84a6b9d13f7c2e5a48
User           : student <student>
Return-Code    : Success
Releasever     : 10
Command Line   : install -y tmux
Comment        :
Packages Altered:
    Install tmux-3.3a-13.20230918gitb202a2f.el10.x86_64 @baseos

Every dnf transaction gets an ID with who ran it, when, the command line and each package with its exact version. This is the first place to look when someone asks “what changed on this server?” (Lesson 65 adds rpm -qa --last for packages installed outside dnf). Now reverse the tmux install:

sudo dnf history undo last -y

You should see something like this (shortened):

Removing:
 tmux        x86_64        3.3a-13.20230918gitb202a2f.el10        @baseos      1.1 M

Transaction Summary
================================================================================
Remove  1 Package
...
Removed:
  tmux-3.3a-13.20230918gitb202a2f.el10.x86_64

Complete!

undo reverses one transaction: installs become removals, removals become installs, upgrades become downgrades. Undoing an upgrade only works if the older version is still in a repo or the cache, so it’s a quick fix, not a replacement for snapshots. dnf history rollback ID undoes everything after a given transaction.

Try it yourself: build the history and undo commands in the Command Builder.

✅ Checkpoint: dnf history list shows a new transaction (Removed) and rpm -q tmux says it isn’t installed.

8Apply only security updates

Run this:

dnf updateinfo summary
dnf updateinfo list --security
sudo dnf upgrade --security --assumeno

You should see something like this (the advisory list changes every week):

Updates Information Summary: available
    3 Security notice(s)
        1 Important Security notice(s)
        2 Moderate Security notice(s)
    2 Bugfix notice(s)
RLSA-2026:9214 Important/Sec. openssl-libs-1:3.5.1-7.el10_2.x86_64
RLSA-2026:9214 Important/Sec. openssl-1:3.5.1-7.el10_2.x86_64
RLSA-2026:9187 Moderate/Sec.  libxml2-2.12.5-9.el10_2.x86_64
RLSA-2026:9160 Moderate/Sec.  curl-8.12.1-4.el10_2.x86_64

Rocky publishes advisories (RLSA, the same as Red Hat’s RHSA) with a severity. --assumeno prints the transaction table and stops with “Operation aborted.”, so you can paste the list into a change request first. Drop it to apply the updates, then check whether a reboot or service restart is needed with sudo dnf needs-restarting -r (Lesson 49 covers kernels and reboots).

Try it yourself: build the security-update commands for dnf or apt in the Command Builder.

✅ Checkpoint: You can say how many security advisories rocky01 has and which packages they touch.

9Clean the cache and rebuild it

Run this:

sudo dnf clean all
sudo dnf makecache

You should see something like this:

37 files removed
Rocky Linux 10 - BaseOS                         4.6 MB/s | 2.6 MB     00:00
Rocky Linux 10 - AppStream                      7.9 MB/s | 9.8 MB     00:01
Rocky Linux 10 - Extras                          21 kB/s |  12 kB     00:00
Metadata cache created.

clean all deletes cached metadata and packages in /var/cache/dnf. Do this when a mirror changed under you, when /var is filling up, or after you edit a repo’s baseurl. makecache downloads fresh metadata now so the next install doesn’t wait.

✅ Checkpoint: makecache ends with “Metadata cache created.”

10Add EPEL the supported way

First try a package that isn’t in Rocky’s repos:

sudo dnf install -y htop

You’ll get:

No match for argument: htop
Error: Unable to find a match: htop

Enable CRB, install the EPEL release package from extras, then try again:

sudo dnf config-manager --set-enabled crb
sudo dnf install -y epel-release
dnf repolist
sudo dnf install -y htop

You should see something like this (repolist, then the key prompt during the htop install):

repo id                 repo name
appstream               Rocky Linux 10 - AppStream
baseos                  Rocky Linux 10 - BaseOS
crb                     Rocky Linux 10 - CRB
epel                    Extra Packages for Enterprise Linux 10 - x86_64
extras                  Rocky Linux 10 - Extras
Importing GPG key 0xE37ED158:
 Userid     : "Fedora (epel10) <epel@fedoraproject.org>"
 Fingerprint: 7D8D 15CB FC4E 6268 8591 FB26 33D9 8517 E37E D158
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-10
Key imported successfully

EPEL packages often need libraries from CRB, which is why Rocky’s documentation enables it first. The first EPEL install asks to import EPEL’s key; -y accepts it, so at work compare the fingerprint with Fedora’s published one before you say yes. EPEL is community-built and not covered by Red Hat support, so many companies allow only a reviewed list of EPEL packages on production servers.

✅ Checkpoint: htop --version prints a version and rpm -qi htop | grep Signature shows key ID e37ed158.

11Build a local repository from the Rocky ISO

On your laptop, put the ISO back in rocky01’s DVD drive (it works while the VM runs):

VBoxManage storageattach rocky01 --storagectl=IDE --port=1 --device=0 --type=dvddrive --medium="C:\Lab\Linux\ISO\Rocky-10.2-x86_64-minimal.iso"

On rocky01, mount it and check for the two repos:

lsblk /dev/sr0
sudo mkdir -p /mnt/rocky-iso
sudo mount -o ro /dev/sr0 /mnt/rocky-iso
ls -d /mnt/rocky-iso/*/repodata

You should see something like this:

NAME MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sr0   11:0    1  1.9G  0 rom
/mnt/rocky-iso/AppStream/repodata
/mnt/rocky-iso/BaseOS/repodata

Write the repo file (paste this whole block):

sudo tee /etc/yum.repos.d/rocky-iso.repo > /dev/null <<'EOF'
[rocky-iso-baseos]
name=Rocky 10.2 ISO - BaseOS
baseurl=file:///mnt/rocky-iso/BaseOS
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10

[rocky-iso-appstream]
name=Rocky 10.2 ISO - AppStream
baseurl=file:///mnt/rocky-iso/AppStream
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10
EOF
sudo dnf --repo 'rocky-iso-*' makecache
dnf --repo 'rocky-iso-*' repoinfo rocky-iso-baseos | grep -E '^Repo-(id|name|status|pkgs|size|baseurl|filename)'

You should see something like this:

Rocky 10.2 ISO - BaseOS                          41 MB/s | 1.4 MB     00:00
Rocky 10.2 ISO - AppStream                       38 MB/s | 210 kB     00:00
Metadata cache created.
Repo-id            : rocky-iso-baseos
Repo-name          : Rocky 10.2 ISO - BaseOS
Repo-status        : enabled
Repo-pkgs          : 392
Repo-size          : 412 M
Repo-baseurl       : file:///mnt/rocky-iso/BaseOS
Repo-filename      : /etc/yum.repos.d/rocky-iso.repo

--repo tells dnf to use only the repos you name (a glob works), which is how you prove a server can install from the ISO with the internet cut off. Both repos are enabled=0 on purpose, so a missing DVD after a reboot can’t break normal dnf commands. The minimal ISO carries only the few hundred packages an installer needs; at work you’d use the full DVD ISO or an internal mirror built with dnf reposync.

On macOS or Linux laptops the ISO path is ~/Lab/Linux/ISO/Rocky-10.2-x86_64-minimal.iso. In the VirtualBox window you can also use Devices, Optical Drives and pick the ISO.

✅ Checkpoint: repoinfo shows rocky-iso-baseos with a file:///mnt/rocky-iso/BaseOS baseurl and a package count above zero.