RPM integrity and scripts

Categories: Linux, Security

Yum repository comes with gpg  and md5 support to verify the validity of the package

You can list installed gpg keys in your system via

It will show the unique id for the installed keys in your  system


To list all information related to a key
rpm -qi pgp-key-unique-id


It will show version, vendor  and much more useful for debugging
To verify a package against the  installed keys

U can use parameter  k with rpm



U will notice ok if passed pgp and md5 check

To. Verify which key used to validate this package h can use


It will show the public key id

Package developer  can add  some scripts to package metadata that run as root

To list scripts inside the rpm package

please notice the


before and after install

and before and after uninstall

to make rpm transaction with skipping scripts  you should use no script parameter to yum

happy consoles


    Leave a Reply

    Your email address will not be published. Required fields are marked *


    This site uses Akismet to reduce spam. Learn how your comment data is processed.