1

I'm interested in checking the integrity of all installed rpm packages on the system.

In case I have the rpm file itself, I'll run rpm -Kv PACKAGE.rpm, but what can I achieve the same goal if I the original rpm is missing?

Is the signature and digest data are stored in the rpm database?

I know i can verify the files inside the rpm by rpm -Va PACKAGE_NAME, but it will only check the files digests and not the signature.

0

If the package already has been installed, then it is too late - thou, there is a small chance that the package is still in /var/cache/{dnf,yum}/.

The best way to check signatures is to create a repo file (even if the baseurl will point to file location) and set gpgcheck 1 in that repo file.

If you will ever run something like: dnf install foo.rpm then you should have in dnf.conf the variable localpkg_gpgcheck set to True, because the default is False.

Additionally, if you run rpm -qi bash, there is a information about a signature:

Signature   : RSA/SHA256, Fri Dec  6 13:24:09 2019, Key ID 50cb390b3c3359c4

All gpg keys are imported in rpmdb and looks like other packages there. So you can do:

$  # suffix of the gpg key from the command above
$ rpm -qa |grep 9c4
gpg-pubkey-3c3359c4-5c6ae44d

$ rpm -qi gpg-pubkey-3c3359c4-5c6ae44d
Name        : gpg-pubkey
Version     : 3c3359c4
Release     : 5c6ae44d
Architecture: (none)
Install Date: Ne 18. srpna 2019, 15:49:39 CEST
Group       : Public Keys
Size        : 0
License     : pubkey
Signature   : (none)
Source RPM  : (none)
Build Date  : Po 18. února 2019, 17:58:53 CET
Build Host  : localhost
Packager    : Fedora (31) <fedora-31-primary@fedoraproject.org>
Summary     : gpg(Fedora (31) <fedora-31-primary@fedoraproject.org>)
Description :
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: rpm-4.14.2.1 (NSS-3)

mQINBFxq3QMBEADUhGfCfP1ijiggBuVbR/pBDSWMC3TWbfC8pt7fhZkYrilzfWUM
fTsikPymSriScONXP6DNyZ5r7tgrIVdVrJvRIqIFRO0mufp9HyfWKDO//Ctyp7OQ
zYw6NVthO/aWpyFfJpj6s4iZsYGqf9gByV8brBB8v8jEsCtVOj1BU3bMbLkMsRI9
+WiLjDYyvopqNBQuIe8ogxSxpYdbUz6+jxzfvhRoBzWdjITd//Gjd90kkrBOMWkO
LTqO133OD1WMT08G5NuQ4KhjYsVvSbBpfdkTcNuP8gBP9LxCQDc+e1eAhZ95g3qk
XLeKEK9j+F+wuG/OrEAxBsscCxXRUB38QH6CFe3UxGoSMnBi+jEhicudo+ItpFOy
7rPaYyRh4Pmu4QHcC83bNjp8NI6zTHrBmVuPqkxMn07GMAQav9ezBXj6umqTX4cU
dsJUavJrJ3u7rT0lhBdiGrQ9zPbL07u2Kn+OXPAC3dKSf7G8TvwNAdry9esGSpi3
8aa1myQYVZvAlsIBkbN3fb1wvDJE5czVhzwQ77V2t66jxeg0o9/2OZVH3CozD2Zj
v28LHuW/jnQHtsQ0fUyQYRmHxNEVkW10GGM7fQwxzpxFFS1O/2XEnfMu7yBHZsgL
SojfUct0FhLhEN/g/IINX9ZCVrzK5/De27CNjYE1cgYD/lTmQ0SyjfKVwwARAQAB
tDFGZWRvcmEgKDMxKSA8ZmVkb3JhLTMxLXByaW1hcnlAZmVkb3JhcHJvamVjdC5v
cmc+iQI+BBMBAgAoAhsPBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCXGrkTQUJ
Es8P/QAKCRBQyzkLPDNZxBmDD/90IFwAfFcQq5ENl7/o2CYQ9k2adTHbV5RoIOWC
/o9I5/btn1y8WDhPOUNmsgbUqRqz6srlVplg+LkpIj67PVLDBwpVbCJC8o1fztd2
MryVqdvu562WVhUorII+iW7nfqD0yv55nH9b/JR1qloUa8LpeKw84JgvxF5wVfyR
id1WjI0DBk2taFR4xCfU5Tb262fbdFj5iB9xskP7oNeS29+SfDjlnybtlFoqr9UA
nY1uvhBPkGmj45SJkpfP+L+kGYXVaUd29M/q/Pt46X1KDvr6Z0l8bSUEk3zfcNdj
uEhtHBqSy1UPPAikGX1Q5wGdu7R7+mv/ARqfI6OC44ipoOMNK1Aiu6+slbPYphwX
ighSz9yYuG0EdWt7akfKR0R04Kuej4LXLWcxTR4l8XDzThYgPP0g+z0XQJrAkVhi
SrzICeC3K1GPSiUtNAxSTL+qWWgwvQyAPNoPV/OYmY+wUxUnKCZpEWPkL79lh6CM
bJx/zlrOMzRumSzaOnKW9AOliviH4Rj89OmDifBEsQ0CewdHN9ly6g4ZFJJGYXJ5
HTb5jdButTC3tDfvH8Z7dtXKdC4iqJCIxj698Xn8UjVefZQ2nbv5eXcZLfHtvbNB
TTv1vvBV4G7aiHKYRSj7HmxhLBZC8Y/nmFAemOoOYDpR5eUmPmSbFayoLfRsFXmC
HLs7cw==
=6hRW
-----END PGP PUBLIC KEY BLOCK-----

And you may decide whether this is a good key.

But I am afraid that this still does not tell you anything whether the rpm payload signature actually match that signed one. :(

| improve this answer | |
  • An interesting thing I noticed is that if I ran rpm -qivv bash, the debug output indicates that the signature is validated: D: read h# 846 Header V3 RSA/SHA1 Signature, key ID c105b9de: OK It seems that the signature of the package is stored in the rpm db, and tested each time a package is queried: rpm -qv --queryformat "%{SIGPGP}\n" bash But still I can't be sure that the signature is validated and not the hash of the file – ImStackWIthWorkOverflow Dec 17 '19 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.