RPMSIGN(8)

💅 RPMSIGN(8) — like, the rpm signing manual but make it make sense

okay bestie, welcome to rpmsign, aka RPM Package Signing ✨ it's the little tool that puts your cryptographic John Hancock on packages so everybody knows it's really you and not some random gremlin on the internet. let's get into it 🎀

---

🌸 SYNOPSIS 🌸

signing packages, the whole vibe

rpmsign --addsign|--resign [rpmsign-options] PACKAGE_FILE ...

rpmsign --delsign PACKAGE_FILE ...

rpmsign --delfilesign PACKAGE_FILE ...

rpmsign-options (the lil extras)

[--rpmv3] [--fskpath KEY] [--signfiles]

---

✨ DESCRIPTION ✨

so <pink>**--addsign**</pink> and <pink>**--resign**</pink>? both of them do the exact same thing: they generate and insert brand-new signatures for every package PACKAGE_FILE you hand them, and they replace any existing signatures while they're at it 💅 there are two of them for historical reasons — literally no behavioural difference right now, it's giving twins who dress identical.

to actually create a signature, rpmsign needs to verify the package's checksum. which means — and this is important, bestie — packages with a MD5/SHA1 checksum cannot be signed in FIPS mode. no cap. 😭

rpmsign --delsign PACKAGE_FILE ...

deletes all signatures from each package PACKAGE_FILE you give it. bye bye signatures 👋

rpmsign --delfilesign PACKAGE_FILE ...

deletes all IMA and fsverity file signatures from each package PACKAGE_FILE. also bye 👋

🔥 SIGN OPTIONS 🔥

• --rpmv3 — force RPM V3 header+payload signature addition. ngl these are expensive and redundant baggage on packages that already have a separate payload digest (aka packages built with rpm >= 4.14). rpmsign will auto-detect when V3 signatures are actually needed, but you can use this to force them into existence if your packages absolutely must be fully signature-verifiable with rpm < 4.14, or for other interoperability reasons. it's giving "I know it's extra but I have my reasons" 🫶
• --fskpath KEY — used with --signfiles, use file signing key KEY.
• --certpath CERT — used with --signverity, use file signing certificate CERT.
• --verityalgo ALG — used with --signverity, to specify the signing algorithm. sha256 and sha512 are supported, with sha256 being the default if you don't specify this argument. this can also be specified with the macro %_verity_algorithm. 🦋
• --signfiles — sign package files. the macro %_binary_filedigest_algorithm must be set to a supported algorithm before building the package. the supported algorithms are SHA1, SHA256, SHA384, and SHA512, which are represented as 2, 8, 9, and 10 respectively. the file signing key (RSA private key) must be set before signing the package, and it can be configured on the command line with --fskpath or the macro %_file_signing_key. ⭐
• --signverity — sign package files with fsverity signatures. the file signing key (RSA private key) and the signing certificate must both be set before signing the package. the key can be configured on the command line with --fskpath or the macro %_file_signing_key, and the cert can be configured on the command line with --certpath or the macro %_file_signing_cert. 💜

---

🔑 CONFIGURING SIGNING KEYS 🔑

okay so to sign packages you need your own public and secret key pair — go read the GnuPG manual, it's a whole thing. and then, rpm(8) has to be configured to find GnuPG and the right keys using these macros:

• %_gpg_name — the name of the "user" whose key you wanna use to sign your packages. typically this is the only configuration you actually need. iconic, low maintenance 👑
• %_gpg_path — the location of your GnuPG keyring, if it's not the default $GNUPGHOME.
• %__gpg — the path of the GnuPG executable. normally pre-configured, so don't stress.

for example, to be able to use GnuPG to sign packages as the user "John Doe <jdoe@foo.com>" from the key rings located in /etc/rpm/.gpg using the executable /opt/bin/gpg, you'd include:

%_gpg_path /etc/rpm/.gpg
%_gpg_name John Doe <jdoe@foo.com>
%__gpg /opt/bin/gpg

in a macro configuration file, typically ~/.config/rpm/macros. see Macro Configuration in rpm(8) for more details. 🧚

---

👀 SEE ALSO 👀

popt(3), rpm(8), rpmdb(8), rpmkeys(8), rpm2cpio(8), rpmbuild(8), rpmspec(8)

rpmsign --help — and listen, because rpm supports customizing the options via popt aliases, it's literally impossible to guarantee that what's described in the manual matches what's actually available. so yeah. check it yourself, bestie. 🙈

http://www.rpm.org/ <URL:http://www.rpm.org/>

---

💖 AUTHORS 💖

shoutout to the legends who built this:

• Marc Ewing <marc@redhat.com>
• Jeff Johnson <jbj@redhat.com>
• Erik Troan <ewt@redhat.com>
• Panu Matilainen <pmatilai@redhat.com>
• Fionnuala Gunter <fin@linux.vnet.ibm.com>
• Jes Sorensen <jsorensen@fb.com>

---

and that's the whole page, babe 🌈 brought to you by Red Hat, Inc, living under the manual name RPMSIGN(8) — mwah, go sign something 💅✨🎀