5. Creating a remote repository

A remote repository directory is a directory that tracks, or mirrors, the contents of a primary repository published on a web site. The lpm command maintains an internal list of remote repositories where packages are automatically searched for missing resources:

lpm --remote --add nickname http://www.domain.com/repository

A unique nickname must be given to each default remote repository. Use lpm --remote --list to list all default remote repositories. --remote --add downloads the GPG keys and the list of packages available for downloading from the repository.

This is not actually the preferred way to create a new remote repository, because the GPG cannot be verified. It's a classical chicken versus the egg situation. There's no way to automatically verify the GPG keys. LPMtool installs the remote repositories in /var/lpmrepositories or /usr/local/var/lpmrepositories (or someplace else, depending on the system configuration):

GNUPGHOME=/var/lpmrepositories/nickname/.gpgdir gpg --list-keys

This command lists the fingerprints of the downloaded GPG keys, which should be verified via some out-of-band channel.

A better way to create a new remote repository is to do let lpm do it by itself. Package files that are correctly prepared will already include the URLs of remote repositories that contains additional packages required by the application, together with their GPG keys, whose authenticity was presumably verified by the application's packager. lpm will prompt and ask for permission to create a new remote repository, and indicate the web site's URL. The remote repository's GPG keys are already known, and the new remote repository can be created securely.