Install packages or update or upgrade Fedora from University IT Center

Ask Fedora
1

In our university we have IT and they said students can use their repo for update or upgrade packages on Linux, for Fedora they give us this config
```
[IT-fedora]
name=Fedora $releasever - $basearch
failovermethod=priority
baseurl= Domain im Kundenauftrag registriert
enabled=1
metadata_expire=7d
repo_gpgcheck=0
type=rpm
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
skip_if_unavailable=False

[IT-updates]
name=Fedora $releasever - $basearch - Updates
failovermethod=priority
baseurl= Domain im Kundenauftrag registriert
enabled=1
repo_gpgcheck=0
type=rpm
gpgcheck=1
metadata_expire=6h
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
skip_if_unavailable=False
```
Is this safe and I can use it?
Can they put bad packages on their repo?
If I use this repo how I can check my Fedora is OK and not hacked?

2

I would be concerned about this.

Is there a reason not to do an in-place upgrade using official repos?

Two days ago I upgraded from 43 to 44 via Software and it went smooth as silk.

Backing up important data is always a prerequisite no matter which route you decide to take.

3

In university we do not have direct access to internet.

4

Yes. Perhaps more likely, if their security is poor, they can be hacked by a bad actor who puts bad packages there.

Normally you’d be protected by the system checking that the packages are signed with Fedora’s GPG key. But your university is telling you to throw away that protection, by using repo_gpgcheck=0. Edit: no, I’m wrong, per @francismontagnac 's post you should still be protected by gpgcheck=1.

5

I don’t think so: this parameter is also set to 0 in the standard fedora and
fedora-updates .repo files.

The setting of gpgcheck=1 is the important one.

I guess that this university is doing an exact mirror of the fedora repos.

6

Oh! You’re right!

7

Then yes, this IT provided repo looks good and you can use it to update.

8

How I can check installed packages health and installed packages did not modified or edited?

9

That is what the gpgcheck=1 does for you when you do the update