RPM yum repo for Fedora/RHEL?

[pgnd]

i just grabbed the openbao amd64 rpm directly.
running it on a Fedora41 box, atm.

is there an rpm repository for Fedora/RHEL, in yum format, to use and keep uptodate?

direct DL is easy enuf; repo is very useful/convenient ...

[DrDaveD]

Probably it should be added as a Fedora/EPEL package. vault never was.

[pgnd]

just double-checked, nothing @ Fedora pkgs i see.

i know IBM bought Hashi; never did see any pkg'ing.

i did NOT realize until a few moments ago that "OpenBao is being incubated by The Linux Foundation, led by IBM developers through LF Edge."

which is mildly confusing.

and, no pkgs either. yet.

[cipherboy]

@pgnd While it is true IBM started this fork, they presently have no active involvement with either HashiCorp or this project as decided by (presumably?) their lawyers while regulators examine the acquisition. See the statement made by Nathan at the start of this meeting: https://lf-edge.atlassian.net/wiki/spaces/OP/pages/15211981/2024-06-13+OpenBao+TSC+Meeting.

The assertion that IBM developers are leading this project is no longer true.

Instead, this project is entirely community run and organized. I am one of the few individuals paid to (mostly) work on this project. This project will continue despite any acquisition of HashiCorp by IBM in the space, as this organization is under the Linux Foundation, an independent third-party. This project's governance is documented in the CONTRIBUTING.md file, in our charter, our MAINTAINERS.md file, and our Development Working Group charter.

---

To the topic at hand...

Fedora packaging is something that hasn't been considered. It requires Fedora packaging bits, which I gave up some time after leaving Red Hat. However, individuals from NixOS, Alpine, Homebrew, and others have packaged OpenBao for those platforms, so it isn't inconceivable that a Fedora packager might be interested. Note that Red Hat is an independent subsidiary of IBM with no active involvement from them. :-)

Perhaps OpenBao can thus be packaged for Fedora, though it would require complying with the Fedora packaging requirements: https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/. I guess a good first step would be to follow the package review process and see if one could find a sponsor: https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/

I had started building a first-party registry here: #529 However, I ran out of skills and time to update this. If you're interested in taking this on, we welcome contributions :-)

Fedora-compatible packages are built, however: https://openbao.org/downloads/ and so you can download them, verify their signatures, and use them despite lacking a repo.

[pgnd]

@cipherboy

re: yes-Ibm, no-Ibm -- aha. thx for the whack-a-mole clarification. impossible to keep up with the lawyers' scurrying! ;-)

complying with the Fedora packaging requirements
which is the rub.
i pkg a # of my own server-pkgs @ COPR, for my use. particulary, when completely absent otherwise ...
i package a couple of go-lang packages; not terribly challenging, and useful.
but mine are very much "do not use", and NOT in compliance with Fedora packaging requirements.

that said, it may be possible to simply push this project's existing RPMs as-is into a COPR repo, or simply hosted elsewhere, without the rpm-(re)build.
the only nice advantage is keeping up with releases & managing upgrades ...

started building a first-party registry here

thx, will take a look!

[DrDaveD]

I have some experience with supporting Fedora/EPEL packages (supporting only one currently) and I have an alternative openbao rpm packaging that is a little closer to meeting their requirements because it avoids accessing anything from the internet at build time. It is based on another packaging I maintain for vault and use on a koji system run by my science research community.

[pgnd]

helpful, thx!

avoids accessing anything from the internet at build time

which is a common Fedora-pkging 'transgression' of my specs ; i grab src from git branch/tag directly, at build time.

[cipherboy]

@pgnd @DrDaveD One of the other portions missing was packaging of vault-selinux. I think we could consider pulling it into our org and supporting it natively if we wanted, and had community members interested in contributing.

That'd really improve the RHEL experience as well.

[pgnd]

vault-selinux
that's not a hard prereq, iiuc, right?

pulling it into our org and supporting it natively

ime, generally a better option than @ Fedora typically. some enterprise pkgs are fine (e.g. postfix, nsd, bind), others lag/suffer badly (e.g., mariadb, nginx); changes over time ...

tho, if a native/local repo is not going to be kept up to date, it's more of a headache than not having it to begin with.

That'd really improve the RHEL experience as well.

having the repo usually improves the adoption rate.
just removes the minor 'barrier' to DL/install/maintain of rpms ...