If you wish to verify that a package has not been corrupted or
tampered with, examine only the md5sum by typing the following
command at a shell prompt (<rpm-file> with file name of the RPM
package):
rpm -K --nosignature <rpm-file>
|
The message <rpm-file>: md5 OK is displayed.
This brief message means that the file was not corrupted by the
download. To see a more verbose message, replace -K with -Kvv in the
command.
On the other hand, how trustworthy is the developer who created
the package? If the package is signed with
the developer's GnuPG key, you know that
the developer really is who they say they are.
An RPM package can be signed using Gnu
Privacy Guard (or GnuPG), to help you make certain your
downloaded package is trustworthy.
GnuPG is a tool for secure communication; it is a complete and
free replacement for the encryption technology of PGP, an
electronic privacy program. With GnuPG, you can authenticate the
validity of documents and encrypt/decrypt data to and from other
recipients. GnuPG is capable of decrypting and verifying PGP
5.x files as well.
During installation, GnuPG is installed by default. That way you
can immediately start using GnuPG to verify any packages that you
receive from Red Hat. First, you must import Red Hat's public
key.
To verify Red Hat packages, you must import the Red Hat GPG key.
To do so, execute the following command at a shell prompt:
rpm --import /usr/share/rhn/RPM-GPG-KEY
|
To display a list of all keys installed for RPM verification,
execute the command:
For the Red Hat key, the output includes:
gpg-pubkey-db42a60e-37ea5438
|
To display details about a specific key, use rpm -qi followed by the output from the previous
command:
rpm -qi gpg-pubkey-db42a60e-37ea5438
|
To check the GnuPG signature of an RPM file after importing the
builder's GnuPG key, use the following command (replace <rpm-file> with filename of the RPM
package):
If all goes well, the following message is displayed:
md5 gpg OK. That means that the
signature of the package has been verified and that it is not
corrupt.
