Fedora Copr

Fedora Copr
Name	Fedora Copr
Developer	Fedora Project
Released	2015
Language	English
License	Various

Fedora Copr

Fedora Copr is a build and repository hosting service for RPM packages used by the Fedora ecosystem. It enables contributors to compile source code into binary RPMs and publish third-party repositories for Fedora and related distributions, integrating with project infrastructure and developer tooling. The service interacts with multiple Fedora subsystems and upstream projects to streamline distribution of experimental and third-party packages.

Overview

Copr provides a platform similar in purpose to Open Build Service, Launchpad (software), OBS Studio (Open Broadcaster Software), GitLab, GitHub, and SourceForge by offering hosted builds and repository publishing for RPM-based distributions. It integrates with Fedora Project, Red Hat, CentOS Project, EPEL, Koji (software), and PackageKit to facilitate package lifecycle tasks. Copr supports inputs from version control systems like Git, GitHub, GitLab (company), and Bitbucket, and can use CI services such as Travis CI, Jenkins, GitHub Actions, GitLab CI, and CircleCI to coordinate builds.

History

Copr originated within initiatives by contributors affiliated with Red Hat and the Fedora Project to provide a lightweight alternative to Koji (software) for third-party packaging. Early ideas were discussed at conferences including FOSDEM, LinuxConf AU, DevConf.cz, Red Hat Summit, and All Things Open. Implementation and maintenance have involved collaboration between individuals from organizations such as Canonical (company), SUSE, Oracle Corporation, and universities including University of Cambridge, Massachusetts Institute of Technology, and University of Toronto. Over time Copr evolved alongside ecosystem changes driven by efforts from Open Source Initiative, Free Software Foundation, Software Freedom Conservancy, and standards work with RPM (software) maintainers and Dovecot contributors.

Architecture and Components

The Copr architecture combines build orchestration, web front end, task queueing, and repository hosting. Core components parallel designs used in systems like Koji (software), Jenkins, Celery (software), RabbitMQ, PostgreSQL, and nginx. Source inputs often flow from GitHub, GitLab (company), Bitbucket, or Gitea to a build executor that uses chroot or containerization technologies such as Docker, Podman, Kubernetes, systemd-nspawn, and chroot environments. Artifact hosting uses HTTP servers analogous to Apache HTTP Server or Nginx, and metadata formats follow RPM (software) and YUM (software) conventions later supplanted by DNF. Authentication and authorization interoperate with identity providers like FreeIPA, OAuth, OpenID Connect, and LDAP.

Workflow and Usage

Users create projects via a web UI or API, submit source via Git, and trigger builds manually or on commit hooks from systems such as GitHub Actions or GitLab CI. Build targets mirror distribution branches like Fedora releases and community spins such as Fedora Silverblue, Fedora KDE, Fedora Workstation, and derivatives including CentOS Stream and AlmaLinux. Typical workflow steps echo patterns from Debian's packaging journeys and Ubuntu PPAs: import sources, define build instructions using spec file conventions, launch builds on workers managed by systemd or Kubernetes, then publish resulting RPMs into a repository served for clients using tools like DNF and Yum-plugin. Integration points include Bugzilla, Pagure, Koji (software), and continuous integration dashboards inspired by Travis CI.

Package Build and Repository Management

Copr supports RPM packaging practices common to RPM Package Manager ecosystems, using spec files and buildroots similar to mock (RPM tool). Build isolation options employ Docker, Podman, and systemd-nspawn or virtualization leveraging KVM via libvirt. Repository generation produces metadata consumed by DNF, Yum, and tooling used by distributions like Fedora Project, CentOS Project, RHEL, Rocky Linux, and AlmaLinux. Package signing relies on mechanisms comparable to GPG signatures and package verification strategies used by Debian and Ubuntu for APT repositories. Management tasks mirror repository hosting projects such as COPR build service alternatives and draw on experiences from Open Build Service and Launchpad (software).

Security and Trust Model

Copr's security posture incorporates sandboxed build environments and privilege separation similar to models used by Koji (software), Open Build Service, and GitHub Actions. Build execution isolation uses container runtimes like Docker and Podman with kernel features such as namespaces and cgroups, and may leverage SELinux and AppArmor policies for confinement. Authentication and auditing integrate with identity systems like FreeIPA, OAuth, and OpenID Connect while audit logs are handled by components analogous to Auditd and systemd-journald. Trust in published artifacts depends on signing keys managed by contributors and organizational practices promoted by Red Hat, Fedora Project, and standards bodies such as OpenPGP groups.

Community and Governance

Copr is governed by contributors from the Fedora Project community and coordinated with stakeholders including Red Hat, CentOS Project, EPEL, and independent packagers. Development discussions occur on communication channels such as Fedora Project (discourse), mailing lists, and at conferences like FOSDEM, DevConf.cz, and Red Hat Summit. The project aligns with policies and governance models similar to those of Fedora Project and interacts with broader open source organizations like the Open Source Initiative and Software Freedom Conservancy. Community roles include maintainers, packagers, CI operators, and upstream maintainers from projects such as RPM (software), Koji (software), DNF, and PackageKit.

Category:Fedora Project