RPMSIGN(1)

📦
version 6.1.0 · 6 versions
, in ubuntu stonking

💅 RPMSIGN(1) — the manual page, but make it cute ✨

okay bestie, so this is rpmsign, part of the general commands manual. it's the tool that handles digital OpenPGP signatures on your rpm packages. think of it as the little signature fairy for your .rpm files 🧚💖

🌸 NAME 🌸

rpmsign — RPM Package Signing. yes that's it. that's the whole name. iconic.

✨ SYNOPSIS ✨

rpmsign {--addsign|--resign} [options] [sign-options] PACKAGE_FILE ...

rpmsign --delsign [options] PACKAGE_FILE ...

rpmsign --delfilesign [options] PACKAGE_FILE ...

so basically: pick an operation, sprinkle some options on top, and point it at your packages 💫

🫶 DESCRIPTION 🫶

rpmsign is the tool you use to manipulate digital OpenPGP signatures on rpm package files. that's the whole job. signature maintenance era.

but here's the tea, bestie: to actually create a signature, rpmsign needs to verify the package's checksum first. and because of that, V4 packages with MD5/SHA1 checksums cannot be signed in FIPS mode. no cap. that's just how it is 😭

👑 OPERATIONS 👑

  • --addsign — Generate and insert a brand new OpenPGP signature for each PACKAGE_FILE you hand it. but lowkey it's polite about it: if a signature with identical parameters already exists, it does nothing at all. no drama. also, an arbitrary number of V6 signatures can be added, so go off 💅
  • --resign — Generates and inserts a new OpenPGP signature for each PACKAGE_FILE, and it replaces any and all previous signatures. out with the old, in with the new. main character energy fr.
  • --delsign — Delete all OpenPGP signatures from each package PACKAGE_FILE given. full clear-out.
  • --delfilesign — Delete all IMA and fsverity file signatures from each package PACKAGE_FILE given. yes, the file-level ones get their own little delete button 🎀

🍓 ARGUMENTS 🍓

  • PACKAGE_FILE — An rpm package file. that's it. that's the argument. it's giving minimalism ✨

💜 OPTIONS 💜

See rpm-common(8) for the options common to all rpm executables. (shared options stay in their own lane, iykyk)

🌈 SIGN OPTIONS 🌈

  • --certpath CERT — Used with --signverity, use file signing certificate CERT.
  • --fskpath KEY — Used with --signfiles, use file signing key KEY. you can totally use a PKCS #11 URI here, as long as OpenSSL has been configured to load the pkcs11 provider. ⚠️ for PKCS #11 keys though, the IMA library cannot calculate the IMA key ID, so you must provide it yourself — this is done via the %_file_signing_key_id macro. typically the key ID is set to the Subject Key Identifier (SKID) of the associated X509 certificate.
  • --key-id KEYID — Use key KEYID for signing. this one overrides the %_openpgp_sign_id configuration. it said "i'll handle the config, thank you" 💅
  • --rpmv3 — Request RPM V3 header+payload signature addition on V4 packages. ngl bestie, these signatures are described as expensive and redundant baggage on packages where a separate payload digest already exists (that means packages built with rpm >= 4.14). Rpmsign will automatically detect when V3 signatures are needed, but you can use this option to explicitly request their creation if the packages must be fully signature verifiable with rpm < 4.14, or for other interoperability reasons.
Has no effect when signing V6 packages. periodt.
  • --rpmv4 — Request RPM V4 header signature addition on V6 packages. useful for making V6 packages signature verifiable with rpm 4.x versions.

the rules here are specific, so listen up 🎧: V4 compatibility signatures are only ever added if the signing algorithm is one of those known to V4: RSA, EcDSA, EdDSA (and original DSA). Only one V4 signature can be present in a package, so this gets added only on the first --addsign with a V4 compatible algorithm, and ignored otherwise.

Has no effect when signing V4 packages.
  • --rpmv6 — Request RPM V6 header signature addition on V4 packages.

this generally always succeeds, because there can be an arbitrary number of V6 signatures on a package. V3/V4 compatibility signatures are added using the same logic as --rpmv4 on a V6 package.

Has no effect when signing V6 packages.
  • --signfiles — Sign package files. the file signing key (an RSA private key) must be set before signing the package — you can configure it on the command line with --fskpath, or via the macro %_file_signing_key.
  • --signverity — Sign package files with fsverity signatures. for this one you need both the file signing key (RSA private key) and the signing certificate set before signing the package. the key can be configured on the command line with --fskpath or the macro %_file_signing_key, and the cert can be configured on the command line with --certpath or the macro %_file_signing_cert. two things, don't forget either one bestie 🫶
  • --verityalgo ALG — Used with --signverity, to specify the signing algorithm. sha256 and sha512 are supported, with sha256 being the default if this argument is not specified. this can also be specified with the macro %_verity_algorithm.

🎀 CONFIGURATION 🎀

so to sign packages you need your own OpenPGP key pair (aka certificate) and you gotta configure rpm(8) to use it. here are the macros on the menu:

  • %_openpgp_sign_id — The fingerprint or keyid of the signing key to use. typically this is the only configuration needed. if omitted, --key-id must be explicitly specified when signing. (so like, one of them has to show up, okay? 😤)
  • %_openpgp_sign — The OpenPGP implementation to use for signing. supported values are "gpg" for GnuPG (default and traditional) and "sq" for Sequoia PGP.

then we got the implementation specific macros:

  • %_gpg_path — The location of your GnuPG keyring if not the default $GNUPGHOME.
  • %_gpg_name — Legacy macro for configuring user id with GnuPG. ⚠️ use the implementation independent and non-ambiguous %_openpgp_sign_id instead. it's giving deprecated, bestie.
  • %_sq_path — The location of your Sequoia configuration if not the default.

🦋 EXAMPLES 🦋

✨ Example 1. Basic setup ✨

Configure RPM to sign packages with Sequoia PGP and a specific key by adding the following contents to the user's rpm-config(5) file (typically ~/.config/rpm/macros):

%_openpgp_sign sq
%_openpgp_sign_id 7B36C3EE0CCE86EDBC3EFF2685B274E29F798E08

✨ Example 2. Basic operations ✨

rpmsign --addsign hello-2.0-1.x64_rpm

Add a signature to hello-2.0-1.x64_rpm package.

rpmsign --resign --key-id 771b18d3d7baa28734333c424344591e1964c5fc
hello-2.0-1.x64_rpm

Replace all signatures in hello-2.0-1.x64_rpm package by a signature using key 771b18d3d7baa28734333c424344591e1964c5fc.

rpmsign --delsign --delfilesign hello-2.0-1.x64_rpm

Delete all signatures from hello-2.0-1.x64_rpm package.

⭐ EXIT STATUS ⭐

On success, 0 is returned, a nonzero failure code otherwise. so 0 = slay, anything else = not slay 💀

🌸 SEE ALSO 🌸

popt(3), rpm(8), rpm-common(8), rpmkeys(8), rpmbuild(1)

rpmsign --help — as rpm supports customizing the options via popt aliases, it's impossible to guarantee that what's described in the manual matches what's available. 😭 yeah. fr fr. the manual is doing its best.

http://www.rpm.org/

and that's the whole page bestie!! this was RPM 6.1.0, dated 2026-08-20 🫶 go sign something iconic 💅✨🎀

📦 where this page comes from