RPM Package Security: Cryptographic Verification and Scriptlet Auditing
Installing software packages from untrusted third-party repositories poses substantial security risks. In RPM-based systems (RHEL, CentOS, Fedora), an RPM is not merely an archive of binaries—it contains cryptographic signatures, file digests, and embedded shell scripts (“scriptlets”) that execute with full root privileges during installation and removal. Here is how to audit RPM package integrity and inspect scriptlets prior to execution. 1. Auditing Installed GPG Keys When YUM/DNF installs signed packages, it checks them against GPG public keys registered in the local RPM database. ...