I have an RPM that is sitting on a server I inherited. On the server is an RPM that is needed for one of the applications that it runs.


Rather than using this mystery rpm, I want to find the equivalent package on epel. yum search xmlrpc returns over a dozen results.

How can I find out where this RPM came from, or at least verify if it is the same package that exists on one of the common repos (epel).

The most information I can find is with rpm --query:

[root@us-devops-build02 tmp]# rpm --query --info -p xmlrpc-epi-0.54.2-1.x86_64.rpm
Name        : xmlrpc-epi                   Relocations: /
Version     : 0.54.2                            Vendor: none
Release     : 1                             Build Date: Wed 23 Oct 2013 09:08:24 PM UTC
Install Date: (not installed)               Build Host: foo.bar
Group       : default                       Source RPM: xmlrpc-epi-0.54.2-1.src.rpm
Size        : 1060096                          License: unknown
Signature   : (none)
Packager    : <autobuild@foo.bar>
URL         : http://example.com/no-uri-given
Summary     : no description given
Description :
no description given

The previous admin had a script that would use this RPM. I don't know why he used this special snowflake instead of using a package from epel. I'm moving the script to puppet so I'd like to use official sources as much as possible.

rpm -kv shows the following

rpm --checksig --verbose xmlrpc-epi-0.54.2-1.x86_64.rpm
    Header SHA1 digest: OK (2f2f1619cd1e251cc37675b57656f1394c74024e)
    MD5 digest: OK (656e5696da9f259a47725dacd38b9697)


Here are all the 'xmlrpc' packages on epel

sems-xmlrpc2di.x86_64 : XMLRPC interface for SEMS
xmlrpc-c-c++.i686 : C++ libraries for xmlrpc-c
xmlrpc-c-c++.x86_64 : C++ libraries for xmlrpc-c
xmlrpc-c-client.i686 : C client libraries for xmlrpc-c
xmlrpc-c-client.x86_64 : C client libraries for xmlrpc-c
xmlrpc-c-client++.i686 : C++ client libraries for xmlrpc-c
xmlrpc-c-client++.x86_64 : C++ client libraries for xmlrpc-c
xmlrpc-c-devel.i686 : Development files for xmlrpc-c based programs
xmlrpc-c-devel.x86_64 : Development files for xmlrpc-c based programs
xmlrpc3-javadoc.noarch : Javadoc for xmlrpc3
erlang-xmlrpc.x86_64 : HTTP 1.1 compliant XML-RPC library for Erlang
koji-hub.noarch : Koji XMLRPC interface
lua-xmlrpc.noarch : Lua package to access and provide XML-RPC services
php-ZendFramework2-XmlRpc.noarch : Zend Framework 2: XML-RPC Component
php-xmlrpc.x86_64 : A module for PHP applications which use the XML-RPC protocol
python-offtrac.noarch : Trac xmlrpc library
python-wordpress-xmlrpc.noarch : WordPress XML-RPC API Integration Library
trac-xmlrpc-plugin.noarch : Allows Trac plugins to export their interface via XML-RPC
xmlrpc-c.i686 : A lightweight RPC library based on XML and HTTP
xmlrpc-c.x86_64 : A lightweight RPC library based on XML and HTTP
xmlrpc-c-apps.x86_64 : Sample XML-RPC applications
xmlrpc3-client.noarch : XML-RPC client implementation
xmlrpc3-client-devel.noarch : Source for XML-RPC client implementation
xmlrpc3-common.noarch : Common classes for XML-RPC client and server implementations
xmlrpc3-common-devel.noarch : Source for common classes of XML-RPC
xmlrpc3-server.noarch : XML-RPC server implementation
xmlrpc3-server-devel.noarch : Source for XML-RPC server implementation
  • Was the build host actually foo.bar? Jan 25 '14 at 0:53
  • no I sanitized out any identifiable information
    – spuder
    Jan 25 '14 at 1:09

You can use:

rpm -Kv xmlrpc-epi-0.54.2-1.x86_64.rpm

to display the package's signature (if it has one). From that you could try and trace back the originator of the package.

The package itself (without signature) could have been rebuild by anyone. If it is not signed I would try (from the generic rpm field data) to see if it was built on the machine itself. You can also try the logs if they go back to October last year to find out when file was copied to the machine if it was not build on it (might have been scp-ed).

  • Thanks for telling me about rpm -K. I've updated the question. Is there an easy way to compare the signature with the signatures of the dozen similar packages on epel ?
    – spuder
    Jan 24 '14 at 18:02
  • There's no signature, as demonstrated by OP's listing of rpm --query. Nov 20 '16 at 22:00

Better don't trust software with dubious origins. See if you find a reputable source for this.

What does depend on this package? If it is a RHEL or EPEL package, just installing that should grab the dependencies.

  • The previous admin used this local repo in one of his scripts. The application that depends on this repo is a proprietary in-house application not in base or epel.
    – spuder
    Jan 24 '14 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.