How can I verify that a PGP key is imported into RPM?

Question

One can import a key with:

rpm --import /path/to/key

But how can you tell later if you have already imported this key? Trying to reimport it will fail with an error and I am trying to avoid this as I am using Puppet to install the key.

Answer 1

You can double check if a key is already imported using rpm -qi gpg-pubkey-<version>-<release>. If it is installed, rpm will give you all the information about it, if not, it'll just exit with a return value of 1, so you could add to your puppet recipe an unless parameter:

exec { "rpm --import /path/to/package":
  # ...
  unless => "rpm -qi gpg-pubkey-<version>-<release> > /dev/null 2>&1"
}

Answer 2

Every key imported adds a rpmdb entry of gpg-pubkey-<left(hex(fingerprint), 8)>-<encoded import date>. Just check for that name (gpg-pubkey) and the appropriate version (the first 8 characters of the key fingerprint in hex) in the rpmdb.