Hi @adrian , we were talking about this issue in fedora stand up. Can you take a look on this?

Looking at the log I see that the mirrorlist interface is used:

http://mirrors.fedoraproject.org/mirrorlist?repo=epel-8&arch=x86_64

and not the metalink interface. In the metalink the mirror does not appear.

Do we have this documented somewhere? What are the practical differences between metalink and mirrorlist? LIke "Metalink interface is more reliable, because ..."?
Does this mean we should use metalink URLs where possible in mock-core-configs?

metalinks have a number of advantages over mirrorlists:

• They include the checksum of the current (and last 2) repomd.xml for the repo. Any mirror it goes to must have a identical checksum for it's repomd.xml. Since that file also has checksums of all the other files and rpms this insures that you only download correct files. If anything is invalid here, dnf goes to the next mirror.
• Since the metalink has the valid repomd.xml's in it, a mirror cannot give you a valid but out of date repo. It must be current (or one of the previous two)
• mirrormanager crawls mirrors and removes out of date ones from metalinks.

so, IMHO, it's best to use metalinks for everything you can due to the increased security.

Let us know if you need anything more on this here... if you can use metalink things should be a bit more secure and also drop out mirrors that are not up to date. :)

Thanks, doing for EPEL-8 here: https://github.com/rpm-software-management/mock/pull/944