CodeIT repository

nginx and Apache httpd builds with HTTP/3, TLS 1.3 and Brotli, for Enterprise Linux.

Supported: EL 7, 8, 9 and 10 — RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux, on x86_64 and aarch64.

CentOS Stream is not supported. We do not test repository packages on CentOS Stream.

Quick install

Detects your release and installs the matching repository package:

curl -fsSL https://repo.codeit.guru/setup | sudo sh

To see exactly what it would do without changing anything:

curl -fsSL https://repo.codeit.guru/setup | sh -s -- --print

That is all it does: work out your release and install one package. If you would rather not pipe a script into a shell, use the next section instead — it is the same result in one command.

Install without the script

Pick your release. The package configures the repository and installs the signing key.

EL 9 — RHEL 9, AlmaLinux 9, Rocky 9

sudo dnf install -y https://repo.codeit.guru/codeit-repo-release.el9.rpm

EL 10

sudo dnf install -y https://repo.codeit.guru/codeit-repo-release.el10.rpm

EL 8

sudo dnf install -y https://repo.codeit.guru/codeit-repo-release.el8.rpm

EL 7 — CentOS 7, RHEL 7

sudo yum install -y https://repo.codeit.guru/codeit-repo-release.el7.rpm

Not sure which you are on? rpm -E %{rhel} prints the EL generation — 7, 8, 9 or 10. Use that rather than /etc/redhat-release: on RHEL 7 the version reads 7Server, and derivatives report anything from 9 to 9.4 to 9-stream.

Some packages need EPEL for their dependencies. This package no longer pulls EPEL in on its own, so enable it yourself if you need it:

sudo dnf install -y epel-release

Verified install

For people who would rather read a package before running it. Every step is optional; the outcome is identical to the command above.

Replace el9 with your release throughout.

1. Download it, without installing

curl -fsSLO https://repo.codeit.guru/codeit-repo-release.el9.rpm

2. Read what it contains

rpm -qip codeit-repo-release.el9.rpm     # description, licence, size
rpm -qlp codeit-repo-release.el9.rpm     # every file it installs
rpm -qp --scripts codeit-repo-release.el9.rpm

The last command prints nothing. The package has no scriptlets — it installs configuration files and keys and runs no code at any point.

3. Check the key against the fingerprint published below

rpm2cpio codeit-repo-release.el9.rpm \
  | cpio -i --quiet --to-stdout ./etc/pki/rpm-gpg/RPM-GPG-KEY-codeit \
  | gpg --show-keys --with-fingerprint

Compare the fingerprint with the table in Signing keys.

Where trust actually comes from. The repository package is fetched over HTTPS, and its own signature cannot tell you anything until you already trust one of our keys — so the fingerprint check above is the step that matters, and it is only as good as your confidence in this page. If that is not enough for your threat model, obtain the fingerprint from a second channel before continuing.

4. Install the file you just inspected

sudo dnf install -y ./codeit-repo-release.el9.rpm

Afterwards, every package from the repository is checked against that key automatically — that is what gpgcheck=1 in the installed /etc/yum.repos.d/codeit.repo does. You can confirm a package is signed before installing it:

sudo dnf download nginx
rpm -Kv nginx-*.rpm

Choose a branch

EL 8, 9 and 10 — module streams

nginx is published as two streams, and httpd as one. Enable the one you want, then install normally:

sudo dnf module enable -y nginx:codeit-stable      # nginx stable
sudo dnf module enable -y nginx:codeit-mainline    # or nginx mainline
sudo dnf module enable -y httpd:codeit             # Apache httpd

sudo dnf install -y nginx

See what is on offer:

dnf module list --disablerepo='*' --enablerepo=CodeIT

EL 7 — a separate repository

EL 7 predates module streams, so the nginx mainline branch is a second repository, disabled by default:

sudo yum-config-manager --enable CodeIT-mainline --save
sudo yum install -y nginx

Check it worked

dnf repolist enabled | grep -i codeit
dnf list available --disablerepo='*' --enablerepo=CodeIT | head

On EL 7 use yum in place of dnf.

Testing and source repositories

Two more repositories are installed and disabled. Enable one per command rather than permanently:

sudo dnf --enablerepo=CodeIT-testing install nginx    # pre-release builds
sudo dnf --enablerepo=CodeIT-source download --source nginx

CodeIT-testing carries builds that have not been released. Do not enable it permanently on anything you care about.

Signing keys

Both keys are published so you can verify them independently.

Used for	Key	Fingerprint
Packages on EL 8, 9, 10 All repository metadata	`MasterOfDevon` <[email protected]> RSA 2048, 2021-12-08	`A841 3774 B3FA A303 D8A6 CD79 5F53 E10D 0918 7DCD`
Packages on EL 7	`teatron (CodeIT)` <[email protected]> RSA 2048, 2016-04-29	`FF42 C2CE 04DC 87ED 8F22 99AF FBF1 407B 898B 43F4`

The EL 7 package installs both keys. EL 7 packages are signed with the older one and will stay that way — machines that added this repository by hand, before it was distributed as a package, trust that key and have no way to learn about another. EL 8 and later install only the current key.

Print the fingerprint of what is installed on your machine at any time:

gpg --show-keys --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-codeit

Removing the repository

sudo dnf remove -y codeit-repo-release

That takes the repository configuration and the keys with it. Packages you already installed stay; remove them first if you want them gone.