13

One can import a key with:

rpm --import /path/to/key

But how can you tell later if you have already imported this key? Trying to reimport it will fail with an error and I am trying to avoid this as I am using Puppet to install the key.

4 Answers 4

10

You can double check if a key is already imported using rpm -qi gpg-pubkey-<version>-<release>. If it is installed, rpm will give you all the information about it, if not, it'll just exit with a return value of 1, so you could add to your puppet recipe an unless parameter:

exec { "rpm --import /path/to/package":
  # ...
  unless => "rpm -qi gpg-pubkey-<version>-<release> > /dev/null 2>&1"
}
3
  • 2
    Better way through some code I found: KEYFILE=/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release; KEYID=$(echo $(gpg --throw-keyids < $KEYFILE)|cut -c11-18|tr [A-Z] [a-z]); rpm -q gpg-pubkey-$KEYID
    – lsd
    Feb 6, 2013 at 13:43
  • 2
    The cut ties you to a specific layout, which does not work on my RHEL6 test system. And gpg now includes sub keys as well as the pub key. So, I ended up using KEYID=$(gpg --throw-keyids $KEYFILE | sed -n '/^pub/s|^[^/]*/\([[:alnum:]]*\) .*|\1|p' | tr [[:upper:]] [[:lower:]])
    – dannysauer
    Feb 24, 2015 at 23:10
  • There's really no need to include the -i option to rpm. That just makes it print all the details about the package which you promptly send to /dev/null. Plain rpm -q package-name will do just fine, without the unnecessary verbosity.
    – TooTea
    Dec 16, 2020 at 9:46
5

Every key imported adds a rpmdb entry of gpg-pubkey-<left(hex(fingerprint), 8)>-<encoded import date>. Just check for that name (gpg-pubkey) and the appropriate version (the first 8 characters of the key fingerprint in hex) in the rpmdb.

1
2

If you just want to verify that the key is imported (without programmatically processing this information) you can list all keys like this:

rpm -qi gpg-pubkey-\* | grep -E ^Packager

or for the ids:

rpm -qi gpg-pubkey-\* | grep -E "^Version  "

This may seem quite obvious to many but I suppose for some it is a more direct answer to (at least the headline of) the question.

0

For me somehow (on Oracle Linux 7) it was necessary to manually copy it into:

/var/lib/rpm/pubkeys/RPM-GPG-KEY-${REPONAME}.key

I could even import the pubkey twice with no error message but validation still failed. But I have not yet found out why. Maybe next time I'll try:

yum makecache

Which is reported to help sometimes, I whish I could find some clear documentation as to what goes where and when, instead of having to use strace and Google.

I hope this helps someone...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.