Skip to main content
emisar

RHEL/Fedora package ops

v0.1.14

Counterpart to the `debian` pack for RHEL/CentOS/Fedora/Alma/Rocky: rpm inventory, dnf check-update, narrow install/remove actions for a single named package. Equivalent risk model to the apt counterpart.

9 allowed by default 4 need approval by default
Pack ID
dnf-rpm
Vendor
emisar
OS
linux
Actions
13
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
rpm dnf

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install dnf-rpm --hash sha256:6cbda184ad9ac66cfa2bebfd45739a0d648cd22be81354b20192d873ced7f512

Setup

Operates on the local runner host — no credentials needed.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Verify root-only packaged files or change DNF package state as root.

rpm.rpm_verifyrpm.dnf_installrpm.dnf_removerpm.dnf_clean_metadatarpm.dnf_upgraderpm.dnf_reinstallrpm.dnf_autoremove

Run the Emisar service as root

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-dnf-rpm-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. Verification can read every packaged file; package actions can run maintainer scripts and change any host state.

Notes

  • Read-only inventory (rpm_qa, rpm_qi, rpm_ql, dnf_check_update, dnf_history, dnf_repolist) needs no privilege. rpm_verify needs root to hash every installed file, including root-only files.

Verify it works

Runs rpm.rpm_qa, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify dnf-rpm

Install and configure a pack walks through the whole sequence on a host.

Actions 13 total

View on GitHub
  • rpm.dnf_autoremove exec high High — service-affecting

    dnf autoremove -y

    Remove packages installed as dependencies that are no longer required by any installed package. Useful for /var/cache cleanup after a large rollback. Read the dry-run before approving (the list can be long).

    View source on GitHub
  • rpm.dnf_check_update exec low Low — read-only or trivially reversible

    dnf check-update

    List available updates. Exits 100 if updates available — non-zero IS the success signal.

    View source on GitHub
  • rpm.dnf_clean_metadata exec medium Medium — changes state, easily reversible

    dnf clean metadata

    Wipe cached repo metadata. Next dnf call refetches.

    View source on GitHub
  • rpm.dnf_history exec low Low — read-only or trivially reversible

    dnf history

    List recent DNF transactions (installs / removes / updates).

    View source on GitHub
  • rpm.dnf_install exec high High — service-affecting

    dnf install -y <pkg>

    Install one package + its dependencies; its scriptlets run as root and can restart the services it ships.

    View source on GitHub
  • rpm.dnf_reinstall exec medium Medium — changes state, easily reversible

    dnf reinstall -y <package>

    Reinstall one package to fix a corrupted on-disk state (missing files, bad checksums). Same version, same config.

    View source on GitHub
  • rpm.dnf_remove exec high High — service-affecting

    dnf remove -y <pkg>

    Remove one package + dependencies that no longer have a reverse-dep; removing a package that backs a running service takes that service down.

    View source on GitHub
  • rpm.dnf_repolist exec low Low — read-only or trivially reversible

    dnf repolist

    List enabled repositories with package counts.

    View source on GitHub
  • rpm.dnf_upgrade exec high High — service-affecting

    dnf upgrade -y <package>

    Upgrade one named package to the latest available version; the package's service may restart mid-upgrade. Use for CVE remediation. Other packages untouched.

    View source on GitHub
  • rpm.rpm_qa exec low Low — read-only or trivially reversible

    rpm -qa

    List all installed RPMs.

    View source on GitHub
  • rpm.rpm_qi exec low Low — read-only or trivially reversible

    rpm -qi <pkg>

    Show details for one package — version, release, install date, signer.

    View source on GitHub
  • rpm.rpm_ql exec low Low — read-only or trivially reversible

    rpm -ql <pkg>

    List all files installed by one package.

    View source on GitHub
  • rpm.rpm_verify exec low Low — read-only or trivially reversible

    rpm -Va (verify all)

    Verify every installed file's checksum / size / perms against the rpm. Lists only mismatches.

    View source on GitHub
← Back to registry
Pack reference  Publish your own