verifying signature of any rpm

sachin_malik · 02-21-2006, 01:05 AM

suppose i download any rpm from any mirror site. now i want to check its signature. plz tell me the way using GPG key method.

recently i downloaded a rpm from a site, but i am unable to find the gpg key for that particular rpm from that site. from where i can found this GPG key.

plz tell me the entire process in details.

timmeke · 02-21-2006, 02:08 AM

If I'm not mistaken, rpms have a built-in key for verification and they will automatically be verified when you install them.

nguyennh · 02-21-2006, 02:09 AM

On RPM , you should use
rpm -V
or
rpm --checksig

On source tarball (.tar.gz or .tar.bz2) you should use gpg tool . Assume you've got <source file>.sig (the signature of <source file> ) and <source file> , all you have to do is :
gpq --verify <source file>.sig <source file>
Hope it helps you .

sachin_malik · 02-21-2006, 09:29 PM

from where i can get this <sourcefile>.sig
plz tell me

nguyennh · 02-21-2006, 09:57 PM

At any trusted sites provide <sourcefile> .
For examples , visit this site
http://mirror.etf.bg.ac.yu/software/utils/pciutils/
You'll see :
pciutils-2.1.10.tar.bz2
pciutils-2.1.10.tar.bz2.sign
It means pciutils-2.1.10.tar.bz2.sign is signature file of pciutils-2.1.10.tar.bz2

Is it clear ?