Learning AlmaLinux - Package Management with DNF5 & Repositories

#Introduction

In the previous episode, Episode 3, we installed AlmaLinux and prepared our first system. Now we get into a skill you'll use every day: package management. Almost all administrative work — installing software, updating the system, adding repositories — revolves around the package manager. On AlmaLinux 9 and 10, that tool is called dnf5, the modern successor to classic dnf.

This episode breaks down dnf5 from basic commands to advanced features like history and rollback, then explains the repository ecosystem that serves as the source of packages on your system.

#Getting to Know DNF5

DNF5 is the new generation package manager that merges dnf and libdnf into a single, faster, more memory-friendly executable. On AlmaLinux 10 it's the default; on AlmaLinux 9 it's available as an option. Its main commands remain familiar — the difference is in speed and ease of use.

dnf5 --version

#Basic Commands

These are the five commands you'll use most often:

sudo dnf5 install -y htop git
dnf5 search cockpit
dnf5 repoquery --installed kernel

The -y flag answers "yes" automatically for confirmations — convenient for scripting, but get in the habit of reading what will be installed first.

#Finding Packages: repoquery

To find out which package provides a file or command, use repoquery:

dnf5 repoquery --whatprovides /usr/sbin/semanage
dnf5 repoquery --whatprovides ifconfig

Both examples above show the classic way to answer the question "which package provides this utility?" — a skill that helps a lot when a tutorial asks for a package you don't recognize.

#DNF5 Configuration

The global dnf5 configuration lives in /etc/dnf/dnf5.conf. Some options you'll often adjust:

[main]
gpgcheck=1
installonly_limit=3
clean_requirements_on_remove=True
best=True

installonly_limit=3 keeps up to three versions of packages that can be installed side by side — very important for the kernel, because you can boot to an older version if a new one misbehaves.

#History and Rollback

Installation mistakes are normal. dnf5 keeps a transaction history that lets you return to a previous state:

dnf5 history

The output contains a list of transactions with their IDs, dates, and the number of changed packages. To view the details of one transaction:

dnf5 history info <ID>
sudo dnf5 history undo <ID>

history undo reverses a given transaction — returning packages to their previous versions. This is a safety net that most installers don't have.

#AlmaLinux Repositories

Packages come from repositories — centralized package sources. AlmaLinux ships with built-in repositories already configured in /etc/yum.repos.d/almalinux.repo.

dnf5 repolist

#Core Repositories

AppStream and its module concept will be covered in more depth in episode 5.

#CRB and Extras

sudo dnf5 config-manager setopt crb.enabled=1

CRB is often needed to build software from source. Extras is usually enabled by default. Don't hesitate to enable CRB when build tooling asks for it — and disable it again when it's not needed.

#Third-Party Repositories

• EPEL (Extra Packages for Enterprise Linux) — managed by the Fedora ecosystem; provides thousands of popular additional packages.

sudo dnf5 install epel-release

• RPM Fusion — for multimedia packages not available in the official repositories due to licensing policy.

#Official Plugin: dnf-almalinux

dnf-almalinux is the official plugin and tools developed by AlmaLinux for distribution needs. One of its functions is simplifying repository and version information management. To ensure the security of all packages, get in the habit of verifying GPG signatures from time to time:

rpm -qa --qf '%{NAME} %{SIGPGP:pgpsig}\n' | head

Official AlmaLinux packages are signed with the GPG key stored at /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux. A valid signature is the first line of defense against tampered packages.

#Common Pitfalls

1. Running dnf5 upgrade without reading. Always review the list of packages that will change before approving — especially when it involves the kernel or critical services.
2. Disabling gpgcheck. This opens the door to fake packages. Never do it.
3. Adding third-party repositories recklessly. The more repositories, the greater the chance of conflicts and security risk.
4. Forgetting dnf5 history. The rollback feature is your best friend — get used to using it when experimenting.
5. Not using the -y flag deliberately. On production systems, it's sometimes safer to let dnf ask for confirmation so you read every change.

#Conclusion

In this episode 4 you've mastered package management with dnf5: the basic install, remove, search, upgrade, and repoquery commands, dnf5.conf configuration, transaction history and rollback, managing the BaseOS, AppStream, CRB, Extras, and EPEL repositories, up to the official dnf-almalinux plugin and GPG verification.

Key takeaways:

• dnf5 is AlmaLinux 9/10's modern package manager — faster, single executable.
• Core commands: dnf5 install, remove, search, upgrade, repoquery.
• dnf5 history gives you the ability to undo/rollback transactions.
• Core repositories: BaseOS, AppStream, CRB, Extras, and Devel.
• EPEL and RPM Fusion are third-party repositories often needed — use them wisely.
• Always keep gpgcheck=1 and verify package signatures.

Package management is your operational foundation. In the next episode, Episode 5, we'll cover Modules (AppStream) & Software Collections — how a single repository can offer many versions of Python, Node.js, or PostgreSQL at once, when to use a module stream, and the Software Collections legacy of the 8.x era that is now replaced by AppStream. See you there!