Koji (software)

Koji (software)
Name	Koji
Developer	Red Hat, Fedora Project, CentOS
Released	2003
Programming language	Python (programming language), JavaScript
Operating system	Linux, Unix-like
Platform	x86, x86-64, ARM
Genre	Build automation, Continuous integration
License	GPLv2

Koji (software) Koji is a distributed build system used to compile, package, and manage RPM-based software for projects such as Fedora Project, Red Hat Enterprise Linux, and CentOS. It orchestrates source tracking, build scheduling, artifact signing, and repository generation across builder hosts and yield integration with tools like Pungi, Mock (software), and MoinMoin-style wikis for documentation. Koji serves as a backbone for release engineering pipelines in large open source distributions and enterprise Red Hat ecosystems.

Overview

Koji originated within Fedora Project infrastructure to replace ad hoc build scripts and coordinate package builds across multiple architectures, integrating with services such as DistGit, Bodhi (software), koji-web and XMLRPC. It exposes APIs consumed by frontends, command-line clients, and automation systems including Jenkins (software), GitLab CI/CD, and Ansible. Koji's model separates source import, build execution, and repository publication, enabling reproducible builds for distributions like Fedora, EPEL, and downstream projects such as CentOS Stream.

Architecture and Components

Koji's architecture centers on a database-backed server, scheduling components, and builder hosts. Core components include the Koji hub (the central PostgreSQL/MySQL-backed server), the Koji web UI, and the Koji builder daemons that run on build nodes. Integration points and ancillary services often include Pungi for compose orchestration, Mock (software) for chroot builders, RPM tooling for packaging, and GPG/OpenPGP for signing artifacts. Koji uses XML-RPC and newer RESTful endpoints, interoperating with systems like KojiWeb, Tito (software), DistGit, and Copr for isolated build streams. Authentication and authorization commonly leverage LDAP, Kerberos, or FreeIPA in enterprise deployments.

Build Process and Features

A typical Koji build begins with source import from Git (software) repositories or manually submitted archives, followed by tag assignment, build scheduling, and execution on builder hosts using Mock (software) or containerized runners such as Docker (software) or Podman. Koji records metadata including buildroots, RPM manifests, and changelogs for traceability, producing signed artifacts and repository metadata consumed by Yum (software), DNF (software), and ZYpp clients. Features include multi-architecture builds (e.g., x86_64 and aarch64), task isolation, incremental rebuilds, buildroot snapshots via Koji snapshots, and dependency tracking for reproducible composes. Integration with Pungi and lorax enables ISO generation and compose workflows used by Fedora Project and Red Hat Enterprise Linux releases.

Use Cases and Adoption

Koji is adopted by major distributions and organizations for build automation, release engineering, and continuous delivery pipelines. Prominent adopters include the Fedora Project, Red Hat Enterprise Linux, CentOS, EPEL, and community services such as Copr and private enterprise build farms. Use cases span nightly builds for OpenStack, package testing for Kubernetes, reproducible builds for LibreOffice, and automated packaging workflows in CI/CD systems like Jenkins (software) and GitLab CI/CD. Enterprises integrate Koji into software supply chains alongside Pulp, Katello, and artifact repositories like Nexus Repository.

Development and Community

Koji development is driven by contributors from Red Hat, the Fedora Project community, and independent maintainers, with development discussions occurring on mailing lists, issue trackers, and community meetings. The project coordinates with related initiatives including Fedora Infrastructure, CentOS Stream, EPEL, and packaging tool projects like rpmdevtools and mock. Contributions span code in Python (programming language), web UI improvements in JavaScript, and integrations with orchestration tools like Ansible and OpenShift Container Platform. Documentation and community support are found through Fedora Project docs, community wikis, and conferences such as FOSDEM and Red Hat Summit.

Security and Compliance

Koji supports secure builds through isolated buildroots, cryptographic artifact signing with GnuPG, role-based access controls using LDAP or FreeIPA, and audit trails stored in the Koji database for compliance. It enables provenance tracking required by supply chain security initiatives exemplified by Software Bill of Materials practices and integrates with vulnerability management workflows tied to CVE databases and advisory systems like Errata Tool. Hardening practices include builder isolation via SELinux, containerization with Podman, and network segmentation common in enterprise Red Hat deployments to meet compliance standards such as FedRAMP and organizational security policies.

Category:Software build tools