RHEL / CentOS / Fedora: Verify GPG Key For Package Update

by

Verifying GPG keys is an important security measure to ensure that packages installed on your system are authentic and have not been tampered with. In Red Hat Enterprise Linux (RHEL), CentOS, and Fedora, you can verify the GPG key for a package update using the following steps:

  1. Import the GPG key for the package repository:
    sudo rpm --import [GPG Key URL or File]

    For example, to import the GPG key for the CentOS Base repository, you can run the following command:

    sudo rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-7
  2. Verify the GPG key for the package:
    sudo rpm -K [Package File]

    For example, to verify the GPG key for the httpd package, you can run the following command:

    sudo rpm -K httpd-2.4.6-88.el7.centos.x86_64.rpm
  3. Check the output of the rpm -K command:
    • If the output says gpg OK, it means the GPG key for the package is valid and the package can be trusted.
    • If the output says gpg KEYID XXXXXX: NOKEY, it means the GPG key for the package is not installed and you need to import it using the rpm --import command.
    • If the output says gpg BAD signature, it means the signature for the package is invalid and the package should not be trusted.

By verifying the GPG key for packages, you can ensure that the packages you install on your system are authentic and have not been tampered with, which helps to keep your system secure.

(colburnschool.edu)

Leave a Comment