tl;dr - it doesn’t exist.
I’m not the first to have asked this.
There’s 2 URLs listed in the XML metadata element: <metadata xmlns="http://linux.duke.edu/metadata/common" xmlns:rpm="http://linux.duke.edu/metadata/rpm" packages="5">, but both links are broken with a 404 error.
Turning to the Internet Archive, I pulled up an old redirect in 2008: http://web.archive.org/web/20081121070242/http://createrepo.baseurl.org/, which had the lovely
FIXME The specification needs better and more current documentation and needs to be included here. :)
Go to that URL today and it still has the TODO message, and the mailing list last had a message in March 2017, so I’m pretty sure the project is dead.
Which was odd because DNF is more recent, so some development is going on somewhere. After poking around and eventually running dnf provides $(which createrepo) I realised there’s a new createrepo_c package, which pointed me at the rpm-software-management Github repo, which states:
there is no reference files for this, so this repository contains a collection of schema files from various sources (under historical/), which will hopefully be used to create a rationalized, uniform definition of what the metadata format actually is.
Ah.