NAME
rpmsign - RPM Package Signing
SYNOPSIS
SIGNING PACKAGES:
rpmsign --addsign|--resign [rpmsign-options] PACKAGE_FILE ...
rpmsign --delsign PACKAGE_FILE ...
rpmsign --delfilesign PACKAGE_FILE ...
rpmsign-options
[--rpmv3] [--fskpath KEY] [--signfiles]
DESCRIPTION
Both of the --addsign and --resign options generate and insert new signatures for each package PACKAGE_FILE given, replacing any existing signatures. There are two options for historical reasons, there is no difference in behavior currently.
To create a signature rpmsign needs to verify the package's checksum. As a result packages with a MD5/SHA1 checksums cannot be signed in FIPS mode.
rpmsign --delsign PACKAGE_FILE ...
Delete all signatures from each package PACKAGE_FILE given.
rpmsign --delfilesign PACKAGE_FILE ...
Delete all IMA and fsverity file signatures from each package PACKAGE_FILE given.
SIGN OPTIONS
- --rpmv3
-
Force RPM V3 header+payload signature addition. These are expensive and redundant baggage on packages where a separate payload digest exists (packages built with rpm >= 4.14). Rpmsign will automatically detect the need for V3 signatures, but this option can be used to force their creation if the packages must be fully signature verifiable with rpm < 4.14 or other interoperability reasons.
- --fskpath KEY
-
Used with --signfiles, use file signing key KEY.
- --certpath CERT
-
Used with --signverity, use file signing certificate CERT.
- --verityalgo ALG
-
Used with --signverity, to specify the signing algorithm. sha256 and sha512 are supported, with sha256 being the default if this argument is not specified. This can also be specified with the macro %_verity_algorithm.
- --signfiles
-
Sign package files. The macro %_binary_filedigest_algorithm must be set to a supported algorithm before building the package. The supported algorithms are SHA1, SHA256, SHA384, and SHA512, which are represented as 2, 8, 9, and 10 respectively. The file signing key (RSA private key) must be set before signing the package, it can be configured on the command line with --fskpath or the macro %_file_signing_key.
- --signverity
-
Sign package files with fsverity signatures. The file signing key (RSA private key) and the signing certificate must be set before signing the package. The key can be configured on the command line with --fskpath or the macro %_file_signing_key, and the cert can be configured on the command line with --certpath or the macro %_file_signing_cert.
CONFIGURING SIGNING KEYS
In order to sign packages, you need to create your own public and secret key pair (see the GnuPG manual). In addition, rpm(8) must be configured to find GnuPG and the appropriate keys with the following macros:
- %_gpg_name
-
The name of the "user" whose key you wish to use to sign your packages. Typically this is the only configuration needed.
- %_gpg_path
-
The location of your GnuPG keyring if not the default $GNUPGHOME.
- %__gpg
-
The path of the GnuPG executable. Normally pre-configured.
For example, to be able to use GnuPG to sign packages as the user "John Doe <[email protected]>" from the key rings located in /etc/rpm/.gpg using the executable /opt/bin/gpg you would include
-
%_gpg_path /etc/rpm/.gpg %_gpg_name John Doe <[email protected]> %__gpg /opt/bin/gpg
in a macro configuration file, typically ~/.config/rpm/macros. See Macro Configuration in rpm(8) for more details.
SEE ALSO
popt(3), rpm(8), rpmdb(8), rpmkeys(8), rpm2cpio(8), rpmbuild(8), rpmspec(8)
rpmsign --help - as rpm supports customizing the options via popt aliases it's impossible to guarantee that what's described in the manual matches what's available.
http://www.rpm.org/ <URL:http://www.rpm.org/>
AUTHORS
-
Marc Ewing <[email protected]> Jeff Johnson <[email protected]> Erik Troan <[email protected]> Panu Matilainen <[email protected]> Fionnuala Gunter <[email protected]> Jes Sorensen <[email protected]>