Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was coping with many problems to get stuck with this one.

I have installed yum repository on server (CentOS 5.6) with:

createrepo -v -s sha yumrepo/

sha is used due to solution to my earlier problem I have found: my reposistory was not accepted. ([Errno -3] Error performing checksum )

generated gpg key with:

gpg --gen-key

sign package with (package was not created on server):

rpm --addsign mypackage-1.0-1.i386.rpm  

check if was signed properly:

rpm -vv --checksig mypackage-1.0-1.i386.rpm 
D: loading keyring from pubkeys in /var/lib/rpm/pubkeys/*.key
D: couldn't find any keys in /var/lib/rpm/pubkeys/*.key
D: loading keyring from rpmdb
D: opening  db index       /var/lib/rpm/Packages rdonly mode=0x0
D: locked   db index       /var/lib/rpm/Packages
D: opening  db index       /var/lib/rpm/Name rdonly mode=0x0
D:  read h#     205 Header sanity check: OK
D: added key gpg-pubkey-c105b9de-4e0fd3a3 to keyring
D:  read h#     313 Header sanity check: OK
D: added key gpg-pubkey-ebb3d90e-4ee5e6e8 to keyring
D: Using legacy gpg-pubkey(s) from rpmdb
D: Expected size:         3126 = lead(96)+sigs(528)+pad(0)+data(2502)
D:   Actual size:         3126
    Header V4 RSA/SHA1 Signature, key ID ebb3d90e: OK
    Header SHA1 digest: OK (6d131be3c792fcc99da662f432c33facc86efc56)
    V4 RSA/SHA1 Signature, key ID ebb3d90e: OK
    MD5 digest: OK (76cfe98c4128d45da894a2b5b970e703)
D: closed   db index       /var/lib/rpm/Name
D: closed   db index       /var/lib/rpm/Packages

and exported my public key with:

gpg --armor --output MY-GPG-KEY --export 'MYNAME'

On client (CentOS 5.6 too) I have created file /etc/yum.repos.d/myrepo.repo with following content:


than as root I have run:

yum clean all
yum install mypackage

and get an error:

Downloading Packages:
mypackage-0.1-1.noarch.rpm                                | 3.0 kB     00:00     
error: rpmts_HdrFromFdno: Header V4 RSA/SHA1 signature: BAD, key ID ebb3d90e


rpm -q gpg-pubkey

What should I do to have my package securely installed ?

share|improve this question

migrated from stackoverflow.com Dec 17 '11 at 16:27

This question came from our site for professional and enthusiast programmers.

Your answer is on this page : http://adminotes.blogspot.fr/2011/12/centos-6-rpm-sign-problem-v4-signatures.html

In summary, v4 signature are used by default in Centos 6, but Centos 5 only supports v3.

Adding --force-v3-sigs flag in your %__gpg_sign_cmd will makes it work.

share|improve this answer

Problem is the gpg key. There is a bug due to which broken signatures are created. I suggest editing myrepo.repo and setting gpgcheck=1.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.