14

One can import a key with:

rpm --import /path/to/key

But how can you tell later if you have already imported this key? Trying to reimport it will fail with an error and I am trying to avoid this as I am using Puppet to install the key.

4 Answers 4

10

You can double check if a key is already imported using rpm -qi gpg-pubkey-<version>-<release>. If it is installed, rpm will give you all the information about it, if not, it'll just exit with a return value of 1, so you could add to your puppet recipe an unless parameter:

exec { "rpm --import /path/to/package":
  # ...
  unless => "rpm -qi gpg-pubkey-<version>-<release> > /dev/null 2>&1"
}
3
  • 2
    Better way through some code I found: KEYFILE=/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release; KEYID=$(echo $(gpg --throw-keyids < $KEYFILE)|cut -c11-18|tr [A-Z] [a-z]); rpm -q gpg-pubkey-$KEYID
    – lsd
    Feb 6, 2013 at 13:43
  • 2
    The cut ties you to a specific layout, which does not work on my RHEL6 test system. And gpg now includes sub keys as well as the pub key. So, I ended up using KEYID=$(gpg --throw-keyids $KEYFILE | sed -n '/^pub/s|^[^/]*/\([[:alnum:]]*\) .*|\1|p' | tr [[:upper:]] [[:lower:]])
    – dannysauer
    Feb 24, 2015 at 23:10
  • There's really no need to include the -i option to rpm. That just makes it print all the details about the package which you promptly send to /dev/null. Plain rpm -q package-name will do just fine, without the unnecessary verbosity.
    – TooTea
    Dec 16, 2020 at 9:46
5

Every key imported adds a rpmdb entry of gpg-pubkey-<left(hex(fingerprint), 8)>-<encoded import date>. Just check for that name (gpg-pubkey) and the appropriate version (the first 8 characters of the key fingerprint in hex) in the rpmdb.

1
3

If you just want to verify that the key is imported (without programmatically processing this information) you can list all keys like this:

rpm -qi gpg-pubkey-\* | grep -E ^Packager

or for the ids:

rpm -qi gpg-pubkey-\* | grep -E "^Version  "

This may seem quite obvious to many but I suppose for some it is a more direct answer to (at least the headline of) the question.

0

For me somehow (on Oracle Linux 7) it was necessary to manually copy it into:

/var/lib/rpm/pubkeys/RPM-GPG-KEY-${REPONAME}.key

I could even import the pubkey twice with no error message but validation still failed. But I have not yet found out why. Maybe next time I'll try:

yum makecache

Which is reported to help sometimes, I whish I could find some clear documentation as to what goes where and when, instead of having to use strace and Google.

I hope this helps someone...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .