YUM and DNF use configuration files in /etc/ to specify a URL for the GPG key used to verify packages in that repository. Other package managers make key management even easier. YUM and DNF can add keys to the RPM database More options for key management are described in the man page included with the rpmkey package. The following command is used to remove a key: $ sudo rpm -e gpg-pubkey-2f86d6a1-5cf7cefb Use this command to get the information on a key: $ rpm -qi gpg-pubkey-2f86d6a1-5cf7cefb Use the following command to list the keys: $ rpm -qa gpg-pubkey* Since the metadata for the key is stored in the RPM database, you can query and delete keys the same as any package. If you have access to the GPG public key, you can use the following command to manually import a key: $ rpm -import RPM-GPG-KEY-EPEL-8 If that is not possible, because the package is not signed or the public key is not available, you may need to specify the -nogpgcheck option to skip this step. The default behavior of rpm commands is to verify the signature of packages during any install or verify interactions. In this case, the 'SIGNATURES NOT OK' message appears because the key has not yet been imported for RPM. Run the following command to use rpm to verify a package: $ rpm -K Į: digests SIGNATURES NOT OK Instead, the signature is only associated with the critical portions of the package.

In fact, you cannot just verify the file with gpg commands because the signature is not of the entire. Since the rpm utility has its own key management, there is no need to import the GPG public keys to your personal GPG keyring. The rpm utility has its own key management For some projects, the key may also be available directly from a source web site. The public key is included in an RPM package, which also configures the yum repo.

YUM and DNF use repository configuration files to provide pointers to the GPG public key locations and assist in importing the keys so that RPM can verify the packages.įor this article, I will use keys and packages from EPEL. The rpm utility uses GPG keys to sign packages and its own collection of imported public keys to verify the packages.

The RPM format has an area specifically reserved to hold a signature of the header and payload. While GPG can sign any file, manually checking package signatures is not scalable for system administrators. To detect and avoid malicious replacement packages, package owners can sign the package files, and consumers can verify those signatures. For many open-source projects, that includes hosting by volunteers. The projects and companies providing the packages utilize content distribution networks (CDNs) and mirror sites to make their packages available to consumers. Large and popular RPM repositories are typically replicated around the world.

Linux system administration skills assessment.

How does gpg mail work