Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I have an RPM that is sitting on a server I inherited. On the server is an RPM that is needed for one of the applications that it runs.


Rather than using this mystery rpm, I want to find the equivalent package on epel. yum search xmlrpc returns over a dozen results.

How can I find out where this RPM came from, or at least verify if it is the same package that exists on one of the common repos (epel).

The most information I can find is with rpm --query:

[root@us-devops-build02 tmp]# rpm --query --info -p xmlrpc-epi-0.54.2-1.x86_64.rpm
Name        : xmlrpc-epi                   Relocations: /
Version     : 0.54.2                            Vendor: none
Release     : 1                             Build Date: Wed 23 Oct 2013 09:08:24 PM UTC
Install Date: (not installed)               Build Host:
Group       : default                       Source RPM: xmlrpc-epi-0.54.2-1.src.rpm
Size        : 1060096                          License: unknown
Signature   : (none)
Packager    : <>
URL         :
Summary     : no description given
Description :
no description given

The previous admin had a script that would use this RPM. I don't know why he used this special snowflake instead of using a package from epel. I'm moving the script to puppet so I'd like to use official sources as much as possible.

rpm -kv shows the following

rpm --checksig --verbose xmlrpc-epi-0.54.2-1.x86_64.rpm
    Header SHA1 digest: OK (2f2f1619cd1e251cc37675b57656f1394c74024e)
    MD5 digest: OK (656e5696da9f259a47725dacd38b9697)


Here are all the 'xmlrpc' packages on epel

sems-xmlrpc2di.x86_64 : XMLRPC interface for SEMS
xmlrpc-c-c++.i686 : C++ libraries for xmlrpc-c
xmlrpc-c-c++.x86_64 : C++ libraries for xmlrpc-c
xmlrpc-c-client.i686 : C client libraries for xmlrpc-c
xmlrpc-c-client.x86_64 : C client libraries for xmlrpc-c
xmlrpc-c-client++.i686 : C++ client libraries for xmlrpc-c
xmlrpc-c-client++.x86_64 : C++ client libraries for xmlrpc-c
xmlrpc-c-devel.i686 : Development files for xmlrpc-c based programs
xmlrpc-c-devel.x86_64 : Development files for xmlrpc-c based programs
xmlrpc3-javadoc.noarch : Javadoc for xmlrpc3
erlang-xmlrpc.x86_64 : HTTP 1.1 compliant XML-RPC library for Erlang
koji-hub.noarch : Koji XMLRPC interface
lua-xmlrpc.noarch : Lua package to access and provide XML-RPC services
php-ZendFramework2-XmlRpc.noarch : Zend Framework 2: XML-RPC Component
php-xmlrpc.x86_64 : A module for PHP applications which use the XML-RPC protocol
python-offtrac.noarch : Trac xmlrpc library
python-wordpress-xmlrpc.noarch : WordPress XML-RPC API Integration Library
trac-xmlrpc-plugin.noarch : Allows Trac plugins to export their interface via XML-RPC
xmlrpc-c.i686 : A lightweight RPC library based on XML and HTTP
xmlrpc-c.x86_64 : A lightweight RPC library based on XML and HTTP
xmlrpc-c-apps.x86_64 : Sample XML-RPC applications
xmlrpc3-client.noarch : XML-RPC client implementation
xmlrpc3-client-devel.noarch : Source for XML-RPC client implementation
xmlrpc3-common.noarch : Common classes for XML-RPC client and server implementations
xmlrpc3-common-devel.noarch : Source for common classes of XML-RPC
xmlrpc3-server.noarch : XML-RPC server implementation
xmlrpc3-server-devel.noarch : Source for XML-RPC server implementation
share|improve this question
Was the build host actually – Mark Wagner Jan 25 '14 at 0:53
no I sanitized out any identifiable information – spuder Jan 25 '14 at 1:09

2 Answers 2

up vote 2 down vote accepted

You can use:

rpm -Kv xmlrpc-epi-0.54.2-1.x86_64.rpm

to display the package's signature (if it has one). From that you could try and trace back the originator of the package.

The package itself (without signature) could have been rebuild by anyone. If it is not signed I would try (from the generic rpm field data) to see if it was built on the machine itself. You can also try the logs if they go back to October last year to find out when file was copied to the machine if it was not build on it (might have been scp-ed).

share|improve this answer
Thanks for telling me about rpm -K. I've updated the question. Is there an easy way to compare the signature with the signatures of the dozen similar packages on epel ? – spuder Jan 24 '14 at 18:02

Better don't trust software with dubious origins. See if you find a reputable source for this.

What does depend on this package? If it is a RHEL or EPEL package, just installing that should grab the dependencies.

share|improve this answer
The previous admin used this local repo in one of his scripts. The application that depends on this repo is a proprietary in-house application not in base or epel. – spuder Jan 24 '14 at 18:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.