Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The cryptographic signature of an RPM can be verified with the rpm -K command. This returns a string containing gpg (or pgp) and ending in OK if the signature is in RPM's database and is valid.

If the package is not signed but the checksums are valid, you'll still get OK, but no gpg.

If the package is signed but the key is missing from the RPM database, you get (GPG) (capital letters) and NOT OKAY, followed by (MISSING KEYS: GPG#deadbeef).

That's handy if I want to figure out what key I should find to install to make my package installation work.

But what if I want to verify which of several keys in my RPM keyring was used to sign a given package?

share|improve this question

3 Answers 3

up vote 2 down vote accepted
rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig}\n'
share|improve this answer

There is a Signature field listed via

rpm -qpi package.rpm
share|improve this answer
    
Perfect. This is just what I need. –  djhaskin987 Apr 26 '13 at 16:01

less <rpm file> -- look at the "Signature" entry ?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.