DNF-MULTISIG(8)

📦 version 4.3.0, in centos-stream 9

💅 DNF-MULTISIG 💅

okay bestie so this is dnf-multisig, a plugin for DNF (that's dnf-plugins-core, atcha girl) and honestly? she's a whole security guard in a sparkly fit. ✨

🌸 NAME 🌸

dnf-multisig — the DNF multisig Plugin, no cap 💖

🦋 DESCRIPTION 🦋

So here's the vibe: this plugin verifies extraordinary RPMv6 signatures when you're installing, reinstalling, upgrading, or downgrading packages from a repository. And if the verification fails?? The whole RPM operation gets aborted. like, nope, not today. 💀

The way she does this is by executing a dedicated rpmkeys(8) tool — that tool is supposed to understand package signatures in RPM version 6 format. And one feature of that format (iconic, honestly) is that you can have multiple signatures on a single RPM package. Obsessed. 👑

If the package has no RPMv6 signature, a signature in version 4 format will be verified instead. And if there's no signature at all? Verification is handled as failed. nothing to check = not passing go 🚫

The dedicated rpmkeys(8) tool trusts public keys in a key store separate from the native RPM database — and there's a reason for that, bestie: the native database might reject storing OpenPGP keys with an unsupported key schema, which is foreseen to be used in RPMv6 signatures. so she keeps her own little vault. 🎀

Public keys that are missing from the separate key store get attempted to be imported from URLs listed in the gpgkey configuration field of the repository the package belongs to. But before importing, a user is asked for a confirmation with the import — unless DNF was invoked with --assumeyes or --assumeno options, in which case you already said what you said. 🙈

You can inspect the key store with this command:

/usr/lib/pqrpm/bin/rpmkeys -D --list

And a key can be deleted from the key store with this one:

/usr/lib/pqrpm/bin/rpmkeys -D --erase KEY_ID

the KEY_ID is the first word in an output of the --list command. iykyk 🔍

Real talk though: users who do not wish to verify the extraordinary RPMv6 signatures should uninstall this plugin. like, just break up with her, it's fine 💔

⭐ CONFIGURATION ⭐

The hard-coded path to the rpmkeys(8) tool is:

/usr/lib/pqrpm/bin/rpmkeys

This plugin respects the gpgkey and gpgcheck fields in a repository configuration. See dnf.conf(5) for more details, bestie, she'll tell you everything 💖

🎀 FILES 🎀

  • /usr/lib/pqrpm/lib/sysimage/rpm — a location of the key store defined by the /usr/lib/pqrpm/bin/rpmkeys tool. that's where her little key collection lives 🗝️

🌈 SEE ALSO 🌈

👑 AUTHOR 👑

See AUTHORS in your Core DNF Plugins distribution 🫶

2026, Red Hat, Licensed under GPLv2+ 🍓

okay that's the whole thing, you're so welcome, go verify those signatures responsibly bestie 💅✨

version 4.3.0 · Aug 11, 2026 · that's the tea, mwah 🧚💖

📦 where this page comes from