Dec 8th, 2010
Verifying Signed RPM Package
Verifying Signed Packages
All Red Hat Enterprise Linux packages are signed with the Red Hat GPG key. GPG stands for GNU Privacy Guard, or GnuPG, a free software package used for ensuring the authenticity of distributed files. For example, a private key (secret key) locks the package while the public key unlocks and verifies the package. If the public key distributed by Red Hat Enterprise Linux does not match the private key during RPM verification, the package may have been
altered and therefore cannot be trusted.
If the disc is mounted in /mnt/cdrom, use the following command to import it into the keyring (a database of trusted keys on the system):
To display a list of all keys installed for RPM verification, execute the following command:
The output will look similar to the following:
To display details about a specific key, use the rpm -qi command followed by the output from the previous command, as in this example:
