[Rpm-maint] [rpm-software-management/rpm] RPM 6.0.0 released! (Discussion #3959)

[Shashank Taliwal]

Hello @pmatilai and RPM Team, and congratulations on the monumental v6.0 release!

Following up on the announcement, we have some in-depth questions from the perspective of developing and maintaining repository management solutions. We are trying to fully understand the downstream impact on the entire ecosystem.

Our questions are focused on the interaction between the new package format, the repository metadata, and the end client:

**Granular Metadata File Changes**: Beyond the repomd.xml file itself, what changes should we expect in the schemas of the detailed metadata files it points to (e.g., primary.xml.gz, filelists.xml.gz)? For instance, will these files now include new fields to represent the stronger checksums, 64-bit file sizes, embedded MIME types, or other new v6-specific attributes?

**Role of Signing in Metadata Creation**: The new multiple signature support is a fantastic feature. How is this multi-signature information intended to be represented within the repository metadata? When a tool like createrepo_c indexes a v6 package, will all signatures be recorded in the repodata? And how are clients expected to interpret and validate against these multiple signatures during a transaction?

**Expected Client Behavior**: Could you clarify the expected client behavior in mixed environments? Specifically:

How will modern clients (e.g., based on libdnf5) behave when a repository contains a mix of v4 and v6 packages?

Conversely, what is the anticipated failure mode for an older, v6-unaware client that encounters v6 package information within the repository metadata? Will it fail gracefully, ignore the package, or error out completely?

**Overall Impact on Repository Managers**: Fundamentally, are there any other significant shifts or potential "gotchas" in the package-to-repository-to-client lifecycle that we should be aware of? As developers of tools that proxy, cache, and generate RPM metadata, our goal is to provide seamless and correct support for v6, and understanding the full picture is critical.

Thank you for your time and for any detailed insights you can provide. This will be immensely helpful for the entire tooling community.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/discussions/3959#discussioncomment-14505865
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/repo-discussions/3959/comments/14505865 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20250924/4588f88a/attachment-0001.htm>