---
name: "rpmkeys"
section: "8"
platform: "linux"
package: "rpm-tools"
version: "6.0.1-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rpmkeys"
---

# rpmkeys(8)

RPM Keyring

## NAME

rpmkeys - RPM Keyring

## SYNOPSIS

**rpmkeys** {**-K**\|**--checksig**} \[options\] *PACKAGE\_FILE* ...

**rpmkeys** {**-d**\|**--delete**\|**-e**\|**--erase**} \[options\] *FINGERPRINT* ...

**rpmkeys** {**-x**\|**--export**} \[options\] \[*FINGERPRINT* ...\]

**rpmkeys** {**-i**\|**--import**} \[options\] *PUBKEY* ...

**rpmkeys** {**-l**\|**--list**} \[options\] \[*FINGERPRINT* ...\]

**rpmkeys** **--rebuild** \[options\] \[rebuild-options\]

## DESCRIPTION

**rpmkeys** is used for manipulating the **rpm** keyring and verifying package digital signatures with the contained keys.

For all available operations, see **OPERATIONS**.

## OPERATIONS

**-K**, **--checksig**

Verify the digests and signatures contained in *PACKAGE\_FILE* to ensure the integrity and origin of the package.

**-d**, **--delete**, **-e**, **--erase**

Erase the key(s) designated by *FINGERPRINT*. The **--delete** and **-d** options are deprecated.

**-x**, **--export**

Output the key(s) designated by *FINGERPRINT* using an ASCII-armor encoding.  If *FINGERPRINT* is not specified, output all keys.

**--import**

Import ASCII-armored public keys. Digital signatures cannot be verified without the corresponding public key (aka certificate).

**-l**, **--list**

List currently imported public key(s) (aka certificates) by their fingerprint and user ID. If no fingerprints are specified, list all keys.

**--rebuild**

Recreate the public key storage. Update to the latest format and drop unreadable keys.

## ARGUMENTS

*FINGERPRINT*

The handle used for all operations on the keys.

*PACKAGE\_FILE*

An **rpm** package file or a manifest.

*PUBKEY*

An ASCII-armored OpenPGP public key (aka certificate).

## OPTIONS

See [**rpm-common**(8)](/rpm-common/8.md) for the options common to all **rpm** executables.

## REBUILD OPTIONS

- **--from** \<**fs**\|**openpgp**\|**rpmdb**\>

  Use the keys from the specified backend to rebuild the currently configured keystore backend. This can be used to convert from one key storage to another.

## OUTPUT

**--checksig**

```
<_PACKAGE_FILE_>: <element> <element> <OK|NOT OK>
```

With **--verbose**:

```
<_PACKAGE_FILE_>:
    <element>: <OK|NOTFOUND|BAD>
    ...
```

**--list**

```
<fingerprint> <name> <userid> public key
```

## CONFIGURATION

There are several configurables affecting the behavior of this verification, see [**rpm-config**(5)](/rpm-config/5.md) for details:

- •

  **%\_keyring**

- •

  **%\_keyringpath**

- •

  **%\_pkgverify\_flags**

- •

  **%\_pkgverify\_level**

## EXIT STATUS

On success, 0 is returned, a nonzero failure code otherwise.

## EXAMPLES

**rpmkeys --export 771b18d3d7baa28734333c424344591e1964c5fc \| sq inspect**

Export key 771b18d3d7baa28734333c424344591e1964c5fc for inspecting with sequoia-sq.

**rpmkeys --erase 771b18d3d7baa28734333c424344591e1964c5fc**

Erase key 771b18d3d7baa28734333c424344591e1964c5fc from the keyring.

**rpmkeys -K hello-2.0-1.x86\_64.rpm**

Verify hello-2.0-1.x86\_64.rpm package file.

## SEE ALSO

[**popt**(3)](/popt/3.md), [**rpm**(8)](/rpm/8.md), [**rpm-common**(8)](/rpm-common/8.md), [**rpm-config**(5)](/rpm-config/5.md), [**rpmsign**(1)](/rpmsign/1.md)

**rpmkeys --help** - as [**rpm**(8)](/rpm/8.md) supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.

**http://www.rpm.org/**