Linux Package Management with RPM
RPM Package States#
An RPM package can be in either of the following states:
- installed
- available, i.e. installable:
- as an individual physical RPM file, such as downloaded from a public RPM repository,
- as a physical RPM file, part of a DNF repository.
Verify the integrity of an available RPM package#
To verify the integrity, i.e. non corruption, of a RPM package: rpm -K. The command runs on the physical file of the RPM package. The command instructs the system to generate hash values based on the header and payload of the RPM physical file and compare them with the hash values stored in the RPM physical file itself.
Wassim@linux:~/Downloads$ rpm -qa Clockify
Wassim@linux:~/Downloads$
Wassim@linux:~/Downloads$ rpm -qi Clockify_Setup_x64.rpm
Name : Clockify
Version : 2.6.2
Release : 4146
Architecture: x86_64
Install Date: (not installed)
Group : default
Size : 337602010
License : unknown
Signature : (none)
Source RPM : Clockify-2.6.2-4146.src.rpm
Build Date : Thu 23 Apr 2026 09:53:06 AM CEST
Build Host : runner-t1nddc8u-project-213-concurrent-0
Relocations : /
Packager : Clockify <[email protected]>
Vendor : Clockify <[email protected]>
URL : https://clockify.me/
Summary : Clockify App 100% Free Time Tracker
Description :
Clockify App 100% Free Time Tracker
Wassim@linux:~/Downloads$
Wassim@linux:~$ cd ~/Downloads/
Wassim@linux:~/Downloads$ rpm -K Clockify_Setup_x64.rpm
Clockify_Setup_x64.rpm: digests OK
Wassim@linux:~/Downloads$
Verify the integrity and authenticity of an available RPM package#
The non-verbose method#
The case of a non-signed package
The case of a signed package
The output of the command is concise. A ‘SIGNATURES NOT OK’ message indicates that there might be an issue with the signature or the RPM physical package is not signed at all:
user1@localhost:~$ find / -name "which-2.21-44.el10.x86_64.rpm" -type f 2>/dev/null
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
user1@localhost:~$
user1@localhost:~$ rpm -K /mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm: digests SIGNATURES NOT OK
user1@localhost:~$
The verbose method#
Example 1:
user1@localhost:~$ rpm -Kv /mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm:
Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
MD5 digest: OK
user1@localhost:~$
The output of rpm -Kv displays a series of results of hash tests, in addition to a signature verification test. The presence of the latter indicates that this package is signed. RPM was not able to successfully verify the signature because it found no associated key. The option -v is case sensitive.
Example 2: the zsh package is available. It is provided by the ‘baseOS’ repo. The physical RPM file of the ‘zsh’ RPM package is located under /mnt/BaseOS according to the repo definition file under ‘/etc/yum.repos.d/’:
user1@localhost:~$ dnf list zsh
Not root, Subscription Management repositories not updated
Last metadata expiration check: 10:46:29 ago on Sun 19 Jul 2026 09:58:18 AM CEST.
Available Packages
zsh.x86_64 5.9-15.el10 baseOS
user1@localhost:~$
user1@localhost:~$ ls /etc/yum.repos.d
local.repo redhat.repo
user1@localhost:~$ cat /etc/yum.repos.d/local.repo
[baseOS]
name = OS software
baseurl = file:///mnt/BaseOS
enabled = 1
gpgcheck = 0
[AppStream]
name = Application software
baseurl = file:///mnt/AppStream
enabled = 1
gpgcheck = 0
user1@localhost:~$ find /mnt/BaseOS -iname "zsh*.rpm"
/mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
user1@localhost:~$
user1@localhost:~$ ls /etc/pki/rpm-gpg
ISV-Container-signing-key RPM-GPG-KEY-redhat-beta RPM-GPG-KEY-redhat-release
user1@localhost:~$ rpm -KV /mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
rpmkeys: --verify: unknown option
user1@localhost:~$ rpm -Kv /mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
/mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm:
Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
MD5 digest: OK
user1@localhost:~$
Example 3: Verify the integrity and authenticity of the ‘Clockify’ package, downloaded from its official website. The tests did not display any results related to signature, which is an indication that the package is not signed.
Wassim@linux:~/Downloads$ ls | grep rpm
3proxy-0.9.6-1.el10_3.x86_64.rpm
Clockify_Setup_x64.rpm
google-chrome-stable_current_x86_64.rpm
hello-2.12.3-1.el10_3.x86_64.rpm
VirtualBox-7.2-7.2.6_172322_el10-1.x86_64.rpm
vlc-3.0.23-1.el10_2.aarch64.rpm
Wassim@linux:~/Downloads$
Wassim@linux:~/Downloads$ rpm -Kv Clockify_Setup_x64.rpm
Clockify_Setup_x64.rpm:
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
MD5 digest: OK
Wassim@linux:~/Downloads$
Confirm the absence of a signature in the package by getting information on the RPM physical file itself:
Wassim@linux:~/Downloads$ rpm -qi Clockify_Setup_x64.rpm
Name : Clockify
Version : 2.6.2
Release : 4146
Architecture: x86_64
Install Date: (not installed)
Group : default
Size : 337602010
License : unknown
Signature : (none)
Source RPM : Clockify-2.6.2-4146.src.rpm
Build Date : Thu 23 Apr 2026 09:53:06 AM CEST
Build Host : runner-t1nddc8u-project-213-concurrent-0
Relocations : /
Packager : Clockify <[email protected]>
Vendor : Clockify <[email protected]>
URL : https://clockify.me/
Summary : Clockify App 100% Free Time Tracker
Description :
Clockify App 100% Free Time Tracker
Wassim@linux:~/Downloads$
The ‘Signature’ field is empty; The physical RPM file is not signed at all. This output is aligned with the one of the rpm -Kv command.
#LessonLearned Using rpm -Kv is more verbose than rpm -K. This is one of the occasions where verbosity helps understand what is being verified.
Verify the integrity of an installed package#
The hash values of installed packages have been automatically stored in the RPM database; The process of verifying the integrity of an installed RPM package is done therefore with another command, rpm -V and the interpretation of the command output is different than with the case of available packages:
Wassim@linux:~/Downloads$ rpm -qa | grep chrome
google-chrome-stable-150.0.7871.100-1.x86_64
Wassim@linux:~/Downloads$
Wassim@linux:~/Downloads$ rpm -V google-chrome-stable-150.0.7871.100-1.x86_64
Wassim@linux:~/Downloads$
Wassim@linux:~/Downloads$
The rpm -V did not generate any output. This is interpreted as a match between the hash values presented by the installed package and the ones stored in the RPM database.
Verify the integrity of an installed package#
One method to verify whether an installed package has been signed is to execute the rpm -qi command then look for the field named ==Signature==:
user1@localhost:~$ rpm -qa which
which-2.21-44.el10.x86_64
user1@localhost:~$
user1@localhost:~$ rpm -qi which
Name : which
Version : 2.21
Release : 44.el10
Architecture: x86_64
Install Date: Mon 25 May 2026 07:03:53 PM CEST
Group : Unspecified
Size : 81642
License : GPL-3.0-only
Signature :
RSA/SHA256, Fri 04 Jul 2025 01:17:22 PM CEST, Key ID 199e2f91fd431d51
RSA/SHA256, Fri 04 Jul 2025 01:17:22 PM CEST, Key ID 199e2f91fd431d51
Source RPM : which-2.21-44.el10.src.rpm
Build Date : Tue 01 Jul 2025 04:04:06 PM CEST
Build Host : x86-vm-05.brew-001.prod.iad2.dc.redhat.com
Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor : Red Hat, Inc.
URL : https://savannah.gnu.org/projects/which/
Summary : Displays where a particular program in your path is located
Description :
The which command shows the full pathname of a specified program, if
the specified program is in your PATH.
user1@localhost:~$
Open Topics#
#TBC How a package issuer signs his package with his private key
#TBC dnf reinstall