During work with RPM packages I frequently need to validate signatures against available GPG keys.


rpm -qip --nosignature <package.rpm> | grep Signature

gives me an Key ID, i.e.:

Signature   : RSA/SHA1, Mon 28. Aug 2019 06:00:00 AM CET, Key ID 1234567890abcdef


gpg --with-fingerprint <RPM-GPG-KEY-package>

gives me a Key Fingerprint:

Key fingerprint = 0987 6543 21FE DCBA 0987 6543 21FE 1234 5678 90AB CDEF

Since it is not easy to compare both outputs, how to get the mentioned Key ID instead of the whole fingerprint?


You can import the GPG key using rpm --import GPGFILE and then run rpmkeys --checksig foo.rpm


During research I've found that the Key ID are usually the last 8 or 16 bytes of the Key Fingerprint. So I wanted to extract just them from the output. How to achieve that?

I've found the following approach which seems to be working:


#! /bin/bash

KEY_FINGERPRINT=$(gpg --with-fingerprint ${KEY_PATH} | grep "Key fingerprint" | cut -d "=" -f 2 | tr -d ' ' | tr '[:upper:]' '[:lower:]')

echo ${KEY_FINGERPRINT} | grep -o '.\{8\}$'
echo ${KEY_FINGERPRINT} | grep -o '.\{16\}$'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.