RPM Package States#

An RPM package can be in either of the following states:

installed
available, i.e. installable:
- as an individual physical RPM file, such as downloaded from a public RPM repository,
- as a physical RPM file, part of a DNF repository.

Install an RPM package#

Wassim@linux:~/Downloads$ rpm -i zoom_x86_64.rpm 
warning: zoom_x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID 9706ac24: NOKEY
error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock (Permission denied)
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$ sudo rpm zoom_x86_64.rpm
[sudo] password for Wassim: 
RPM version 4.19.1.1
Copyright (C) 1998-2002 - Red Hat, Inc.
This program may be freely redistributed under the terms of the GNU GPL

Usage: rpm [-afgpqlsiv?] [-a|--all] [-f|--file] [--path] [-g|--group] [-p|--package]
        [--pkgid] [--hdrid] [-q|--query] [--triggeredby] [--whatconflicts]
        [--whatrequires] [--whatobsoletes] [--whatprovides] [--whatrecommends]
        [--whatsuggests] [--whatsupplements] [--whatenhances] [--nomanifest]
        [-c|--configfiles] [-d|--docfiles] [-L|--licensefiles] [-A|--artifactfiles]
        [--noghost] [--noconfig] [--noartifact] [--dump] [-l|--list]
        [--queryformat=QUERYFORMAT] [-s|--state] [--nofiledigest] [--nofiles] [--nodeps]
        [--noscript] [--allfiles] [--allmatches] [--badreloc] [-e|--erase=<package>+]
        [--excludedocs] [--excludepath=<path>] [--force] [-F|--freshen=<packagefile>+]
        [-h|--hash] [--ignorearch] [--ignoreos] [--ignoresize] [--noverify]
        [-i|--install] [--justdb] [--nodb] [--nodeps] [--nofiledigest] [--nocontexts]
        [--nocaps] [--noorder] [--noscripts] [--notriggers] [--oldpackage] [--percent]
        [--prefix=<dir>] [--relocate=<old>=<new>] [--replacefiles] [--replacepkgs]
        [--test] [-U|--upgrade=<packagefile>+] [--reinstall=<packagefile>+]
        [--restore=<packagefile>+] [-D|--define='MACRO EXPR'] [--undefine=MACRO]
        [-E|--eval='EXPR'] [--target=CPU-VENDOR-OS] [--macros=<FILE:...>] [--load=<FILE>]
        [--noplugins] [--nodigest] [--nosignature] [--rcfile=<FILE:...>] [-r|--root=ROOT]
        [--dbpath=DIRECTORY] [--querytags] [--showrc] [--quiet] [-v|--verbose]
        [--version] [-?|--help] [--usage] [--scripts] [--conflicts] [--obsoletes]
        [--provides] [--requires] [--recommends] [--suggests] [--supplements]
        [--enhances] [--info] [--changelog] [--changes] [--xml] [--triggers]
        [--filetriggers] [--last] [--dupes] [--filesbypkg] [--fileclass] [--filecolor]
        [--fileprovide] [--filerequire] [--filecaps]
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$ sudo rpm -iv zoom_x86_64.rpm 
warning: zoom_x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID 9706ac24: NOKEY
Verifying packages...
Preparing packages...
zoom-7.1.5.4332-1.x86_64
run post install script, action is 1...
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$ rpm -qa zoom
zoom-7.1.5.4332-1.x86_64
Wassim@linux:~/Downloads$

Verify the integrity of an available RPM package#

To verify the integrity, i.e. non corruption, of a RPM package: rpm -K. The command runs on the physical file of the RPM package. The command instructs the system to generate hash values based on the header and payload of the RPM physical file and compare them with the hash values stored in the RPM physical file itself.

Wassim@linux:~/Downloads$ rpm -qa Clockify
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$ rpm -qi Clockify_Setup_x64.rpm
Name        : Clockify
Version     : 2.6.2
Release     : 4146
Architecture: x86_64
Install Date: (not installed)
Group       : default
Size        : 337602010
License     : unknown
Signature   : (none)
Source RPM  : Clockify-2.6.2-4146.src.rpm
Build Date  : Thu 23 Apr 2026 09:53:06 AM CEST
Build Host  : runner-t1nddc8u-project-213-concurrent-0
Relocations : / 
Packager    : Clockify <support@clockify.me>
Vendor      : Clockify <support@clockify.me>
URL         : https://clockify.me/
Summary     : Clockify App 100% Free Time Tracker
Description :
Clockify App 100% Free Time Tracker
Wassim@linux:~/Downloads$

Wassim@linux:~$ cd ~/Downloads/
Wassim@linux:~/Downloads$ rpm -K Clockify_Setup_x64.rpm 
Clockify_Setup_x64.rpm: digests OK
Wassim@linux:~/Downloads$

Verify the integrity and authenticity of an available RPM package#

The non-verbose method#

The case of a non-signed package

The case of a signed package

The output of the command is concise. A ‘SIGNATURES NOT OK’ message indicates that there might be an issue with the signature or the RPM physical package is not signed at all:

user1@localhost:~$ find / -name "which-2.21-44.el10.x86_64.rpm" -type f 2>/dev/null
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
user1@localhost:~$ 
user1@localhost:~$ rpm -K /mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm: digests SIGNATURES NOT OK
user1@localhost:~$

The verbose method#

Example 1:

user1@localhost:~$ rpm -Kv /mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm
/mnt/BaseOS/Packages/which-2.21-44.el10.x86_64.rpm:
    Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    MD5 digest: OK
user1@localhost:~$

The output of rpm -Kv displays a series of results of hash tests, in addition to a signature verification test. The presence of the latter indicates that this package is signed. RPM was not able to successfully verify the signature because it found no associated key. The option -v is case sensitive.

Example 2: the zsh package is available. It is provided by the ‘baseOS’ repo. The physical RPM file of the ‘zsh’ RPM package is located under /mnt/BaseOS according to the repo definition file under ‘/etc/yum.repos.d/’:

user1@localhost:~$ dnf list zsh
Not root, Subscription Management repositories not updated
Last metadata expiration check: 10:46:29 ago on Sun 19 Jul 2026 09:58:18 AM CEST.
Available Packages
zsh.x86_64                                                                                 5.9-15.el10                                                                                  baseOS
user1@localhost:~$ 
user1@localhost:~$ ls /etc/yum.repos.d
local.repo  redhat.repo
user1@localhost:~$ cat /etc/yum.repos.d/local.repo
[baseOS]
name = OS software
baseurl = file:///mnt/BaseOS
enabled = 1
gpgcheck = 0

[AppStream]
name = Application software
baseurl = file:///mnt/AppStream
enabled = 1
gpgcheck = 0
user1@localhost:~$ find /mnt/BaseOS -iname "zsh*.rpm"
/mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
user1@localhost:~$ 
user1@localhost:~$ ls /etc/pki/rpm-gpg
ISV-Container-signing-key  RPM-GPG-KEY-redhat-beta  RPM-GPG-KEY-redhat-release

user1@localhost:~$ rpm -KV /mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
rpmkeys: --verify: unknown option
user1@localhost:~$ rpm -Kv /mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm
/mnt/BaseOS/Packages/zsh-5.9-15.el10.x86_64.rpm:
    Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    MD5 digest: OK
user1@localhost:~$

Example 3: Verify the integrity and authenticity of the ‘Clockify’ package, downloaded from its official website. The tests did not display any results related to signature, which is an indication that the package is not signed.

Wassim@linux:~/Downloads$ ls | grep rpm
3proxy-0.9.6-1.el10_3.x86_64.rpm
Clockify_Setup_x64.rpm
google-chrome-stable_current_x86_64.rpm
hello-2.12.3-1.el10_3.x86_64.rpm
VirtualBox-7.2-7.2.6_172322_el10-1.x86_64.rpm
vlc-3.0.23-1.el10_2.aarch64.rpm
Wassim@linux:~/Downloads$

Wassim@linux:~/Downloads$ rpm -Kv Clockify_Setup_x64.rpm
Clockify_Setup_x64.rpm:
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK
Wassim@linux:~/Downloads$

Confirm the absence of a signature in the package by getting information on the RPM physical file itself:

Wassim@linux:~/Downloads$ rpm -qi Clockify_Setup_x64.rpm
Name        : Clockify
Version     : 2.6.2
Release     : 4146
Architecture: x86_64
Install Date: (not installed)
Group       : default
Size        : 337602010
License     : unknown
Signature   : (none)
Source RPM  : Clockify-2.6.2-4146.src.rpm
Build Date  : Thu 23 Apr 2026 09:53:06 AM CEST
Build Host  : runner-t1nddc8u-project-213-concurrent-0
Relocations : / 
Packager    : Clockify <support@clockify.me>
Vendor      : Clockify <support@clockify.me>
URL         : https://clockify.me/
Summary     : Clockify App 100% Free Time Tracker
Description :
Clockify App 100% Free Time Tracker
Wassim@linux:~/Downloads$

The ‘Signature’ field is empty; The physical RPM file is not signed at all. This output is aligned with the one of the rpm -Kv command.

#LessonLearned Using rpm -Kv is more verbose than rpm -K. This is one of the occasions where verbosity helps understand what is being verified.

Verify the integrity of an installed package#

The hash values of installed packages have been automatically stored in the RPM database; The process of verifying the integrity of an installed RPM package is done therefore with another command, rpm -V and the interpretation of the command output is different than with the case of available packages:

Wassim@linux:~/Downloads$ rpm -qa | grep chrome
google-chrome-stable-150.0.7871.100-1.x86_64
Wassim@linux:~/Downloads$

Wassim@linux:~/Downloads$ rpm -V google-chrome-stable-150.0.7871.100-1.x86_64
Wassim@linux:~/Downloads$ 
Wassim@linux:~/Downloads$

The rpm -V did not generate any output. This is interpreted as a match between the hash values presented by the installed package and the ones stored in the RPM database.

Verify the authenticity of an installed package#

One method to verify whether the signature of an installed package is valid is to execute the rpm -qi command then look for the field named ==Signature==:

user1@localhost:~$ rpm -qa which
which-2.21-44.el10.x86_64

user1@localhost:~$ 
user1@localhost:~$ rpm -qi which
Name        : which
Version     : 2.21
Release     : 44.el10
Architecture: x86_64
Install Date: Mon 25 May 2026 07:03:53 PM CEST
Group       : Unspecified
Size        : 81642
License     : GPL-3.0-only
Signature   :
              RSA/SHA256, Fri 04 Jul 2025 01:17:22 PM CEST, Key ID 199e2f91fd431d51
              RSA/SHA256, Fri 04 Jul 2025 01:17:22 PM CEST, Key ID 199e2f91fd431d51
Source RPM  : which-2.21-44.el10.src.rpm
Build Date  : Tue 01 Jul 2025 04:04:06 PM CEST
Build Host  : x86-vm-05.brew-001.prod.iad2.dc.redhat.com
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : https://savannah.gnu.org/projects/which/
Summary     : Displays where a particular program in your path is located
Description :
The which command shows the full pathname of a specified program, if
the specified program is in your PATH.
user1@localhost:~$

Importing GPG keys#

GPG keys are public keys that are used to verify the signature of a package, i.e. to verify its authenticity. A fresh RHEL10 lab installation comes with the default Red Hat public key (GnuPG Key) stored in a key file named ‘RPM-GPP-KEY-redhat-release’:

user1@rhel10-vm2:~$ ls /etc/pki/rpm-gpg/
ISV-Container-signing-key  RPM-GPG-KEY-redhat-beta  RPM-GPG-KEY-redhat-release
user1@rhel10-vm2:~$

The public key file contains the public key. Example of the Red Hat public keys:

user1@localhost:~$ cat /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
The following public key can be used to verify RPM packages built and
signed by Red Hat, Inc.  This key is used for packages in Red Hat
products shipped after November 2009, and for all updates to those
products.

Questions about this key should be sent to security@redhat.com.

pub   4096R/FD431D51 2009-10-22
      Key fingerprint = 567E 347A D004 4ADE 55BA  8A5F 199E 2F91 FD43 1D51
uid                  Red Hat, Inc. (release key 2) <security@redhat.com>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

mQINBErgSTsBEACh2A4b0O9t+vzC9VrVtL1AKvUWi9OPCjkvR7Xd8DtJxeeMZ5eF
0HtzIG58qDRybwUe89FZprB1ffuUKzdE+HcL3FbNWSSOXVjZIersdXyH3NvnLLLF
0DNRB2ix3bXG9Rh/RXpFsNxDp2CEMdUvbYCzE79K1EnUTVh1L0Of023FtPSZXX0c
u7Pb5DI5lX5YeoXO6RoodrIGYJsVBQWnrWw4xNTconUfNPk0EGZtEnzvH2zyPoJh
XGF+Ncu9XwbalnYde10OCvSWAZ5zTCpoLMTvQjWpbCdWXJzCm6G+/hx9upke546H
5IjtYm4dTIVTnc3wvDiODgBKRzOl9rEOCIgOuGtDxRxcQkjrC+xvg5Vkqn7vBUyW
9pHedOU+PoF3DGOM+dqv+eNKBvh9YF9ugFAQBkcG7viZgvGEMGGUpzNgN7XnS1gj
/DPo9mZESOYnKceve2tIC87p2hqjrxOHuI7fkZYeNIcAoa83rBltFXaBDYhWAKS1
PcXS1/7JzP0ky7d0L6Xbu/If5kqWQpKwUInXtySRkuraVfuK3Bpa+X1XecWi24JY
HVtlNX025xx1ewVzGNCTlWn1skQN2OOoQTV4C8/qFpTW6DTWYurd4+fE0OJFJZQF
buhfXYwmRlVOgN5i77NTIJZJQfYFj38c/Iv5vZBPokO6mffrOTv3MHWVgQARAQAB
tDNSZWQgSGF0LCBJbmMuIChyZWxlYXNlIGtleSAyKSA8c2VjdXJpdHlAcmVkaGF0
LmNvbT6JAjYEEwEIACACGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAUCSuBJPAAK
CRAZni+R/UMdUfIkD/9m3HWv07uJG26R3KBexTo2FFu3rmZs+m2nfW8R3dBX+k0o
AOFpgJCsNgKwU81LOPrkMN19G0+Yn/ZTCDD7cIQ7dhYuDyEX97xh4une/EhnnRuh
ASzR+1xYbj/HcYZIL9kbslgpebMn+AhxbUTQF/mziug3hLidR9Bzvygq0Q09E11c
OZL4BU6J2HqxL+9m2F+tnLdfhL7MsAq9nbmWAOpkbGefc5SXBSq0sWfwoes3X3yD
Q8B5Xqr9AxABU7oUB+wRqvY69ZCxi/BhuuJCUxY89ZmwXfkVxeHl1tYfROUwOnJO
GYSbI/o41KBK4DkIiDcT7QqvqvCyudnxZdBjL2QU6OrIJvWmKs319qSF9m3mXRSt
ZzWtB89Pj5LZ6cdtuHvW9GO4qSoBLmAfB313pGkbgi1DE6tqCLHlA0yQ8zv99OWV
cMDGmS7tVTZqfX1xQJ0N3bNORQNtikJC3G+zBCJzIeZleeDlMDQcww00yWU1oE7/
To2UmykMGc7o9iggFWR2g0PIcKsA/SXdRKWPqCHG2uKHBvdRTQGupdXQ1sbV+AHw
ycyA/9H/mp/NUSNM2cqnBDcZ6GhlHt59zWtEveiuU5fpTbp4GVcFXbW8jStj8j8z
1HI3cywZO8+YNPzqyx0JWsidXGkfzkPHyS4jTG84lfu2JG8m/nqLnRSeKpl20Q==
=79bX
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGIpIp4BEAC/o5e1WzLIsS6/JOQCs4XYATYTcf6B6ALzcP05G0W3uRpUQSrL
FRKNrU8ZCelm/B+XSh2ljJNeklp2WLxYENDOsftDXGoyLr2hEkI5OyK267IHhFNJ
g+BN+T5Cjh4ZiiWij6o9F7x2ZpxISE9M4iI80rwSv1KOnGSw5j2zD2EwoMjTVyVE
/t3s5XJxnDclB7ZqL+cgjv0mWUY/4+b/OoRTkhq7b8QILuZp75Y64pkrndgakm1T
8mAGXV02mEzpNj9DyAJdUqa11PIhMJMxxHOGHJ8CcHZ2NJL2e7yJf4orTj+cMhP5
LzJcVlaXnQYu8Zkqa0V6J1Qdj8ZXL72QsmyicRYXAtK9Jm5pvBHuYU2m6Ja7dBEB
Vkhe7lTKhAjkZC5ErPmANNS9kPdtXCOpwN1lOnmD2m04hks3kpH9OTX7RkTFUSws
eARAfRID6RLfi59B9lmAbekecnsMIFMx7qR7ZKyQb3GOuZwNYOaYFevuxusSwCHv
4FtLDIhk+Fge+EbPdEva+VLJeMOb02gC4V/cX/oFoPkxM1A5LHjkuAM+aFLAiIRd
Np/tAPWk1k6yc+FqkcDqOttbP4ciiXb9JPtmzTCbJD8lgH0rGp8ufyMXC9x7/dqX
TjsiGzyvlMnrkKB4GL4DqRFl8LAR02A3846DD8CAcaxoXggL2bJCU2rgUQARAQAB
tDVSZWQgSGF0LCBJbmMuIChhdXhpbGlhcnkga2V5IDMpIDxzZWN1cml0eUByZWRo
YXQuY29tPokCUgQTAQgAPBYhBH5GJCWMQGU11W1vE1BU5KRaY0CzBQJiKSKeAhsD
BQsJCAcCAyICAQYVCgkICwIEFgIDAQIeBwIXgAAKCRBQVOSkWmNAsyBfEACuTN/X
YR+QyzeRw0pXcTvMqzNE4DKKr97hSQEwZH1/v1PEPs5O3psuVUm2iam7bqYwG+ry
EskAgMHi8AJmY0lioQD5/LTSLTrM8UyQnU3g17DHau1NHIFTGyaW4a7xviU4C2+k
c6X0u1CPHI1U4Q8prpNcfLsldaNYlsVZtUtYSHKPAUcswXWliW7QYjZ5tMSbu8jR
OMOc3mZuf0fcVFNu8+XSpN7qLhRNcPv+FCNmk/wkaQfH4Pv+jVsOgHqkV3aLqJeN
kNUnpyEKYkNqo7mNfNVWOcl+Z1KKKwSkIi3vg8maC7rODsy6IX+Y96M93sqYDQom
aaWue2gvw6thEoH4SaCrCL78mj2YFpeg1Oew4QwVcBnt68KOPfL9YyoOicNs4Vuu
fb/vjU2ONPZAeepIKA8QxCETiryCcP43daqThvIgdbUIiWne3gae6eSj0EuUPoYe
H5g2Lw0qdwbHIOxqp2kvN96Ii7s1DK3VyhMt/GSPCxRnDRJ8oQKJ2W/I1IT5VtiU
zMjjq5JcYzRPzHDxfVzT9CLeU/0XQ+2OOUAiZKZ0dzSyyVn8xbpviT7iadvjlQX3
CINaPB+d2Kxa6uFWh+ZYOLLAgZ9B8NKutUHpXN66YSfe79xFBSFWKkJ8cSIMk13/
Ifs7ApKlKCCRDpwoDqx/sjIaj1cpOfLHYjnefg==
=UZd/
-----END PGP PUBLIC KEY BLOCK-----
user1@localhost:~$ 
user1@localhost:~$

No public keys are imported into RPM packages with a default Red Hat 10 installation:

user1@rhel10-vm2:~$ rpm -qa gpg-pubkey*
user1@rhel10-vm2:~$

It is incorrect to infer that the signatures of installed packages have not been already verified just because no public key packages are observed with rpm -qa gpgpubkey*. A correct assumption is that Red Hat public keys were consulted during OS installation and that the system consults them to verify package signature.

The observed content of ‘redhat.repo’ confirms this; The Red Hat repo definition file contains many sections. Almost all sections that require a signature check reference the Red Hat public key physical file directly:

user1@rhel10-vm2:~$ cat /etc/yum.repos.d/redhat.repo
#
# Certificate-Based Repositories
# Managed by (rhsm) subscription-manager
#
# *** This file is auto-generated.  Changes made here will be overwritten. ***
# *** Use "subscription-manager repo-override --help" if you wish to make changes. ***
#
# If this file is empty and this system is subscribed, consider
# running "dnf repolist" to refresh the available repositories.
#

[rhel-10-for-x86_64-appstream-source-rpms]
name = Red Hat Enterprise Linux 10 for x86_64 - AppStream (Source RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel10/$releasever/x86_64/appstream/source/SRPMS
enabled = 0
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
sslverify = 1
sslcacert = /etc/rhsm/ca/redhat-uep.pem
sslclientkey = /etc/pki/entitlement/4944725476477753297-key.pem
sslclientcert = /etc/pki/entitlement/4944725476477753297.pem
metadata_expire = 86400
enabled_metadata = 0

<output omitted for brevity>

[rhel-10-for-x86_64-nfv-source-rpms]
name = Red Hat Enterprise Linux 10 for x86_64 - Real Time for NFV (Source RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel10/$releasever/x86_64/nfv/source/SRPMS
enabled = 0
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
sslverify = 1
sslcacert = /etc/rhsm/ca/redhat-uep.pem
sslclientkey = /etc/pki/entitlement/4944725476477753297-key.pem
sslclientcert = /etc/pki/entitlement/4944725476477753297.pem
metadata_expire = 86400
enabled_metadata = 0

<output omitted for brevity>

Import the official Red Hat 10 GPG key from the Red Hat key file into the RPM keyring.

user1@rhel10-vm2:~$ rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release 
error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock (Permission denied)
error: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: key 1 import failed.
error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock (Permission denied)
error: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: key 2 import failed.
user1@rhel10-vm2:~$ 
user1@rhel10-vm2:~$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
[sudo] password for user1: 
user1@rhel10-vm2:~$

Verify it has been imported correctly:

user1@rhel10-vm2:~$ rpm -qa gpg-pubkey*
gpg-pubkey-fd431d51-4ae0493b
gpg-pubkey-5a6340b3-6229229e
user1@rhel10-vm2:~$

Open Topics#

#TBC verify in lab that rpm automatically performs a signature verification when installing a Red hat package and that the Red Hat public keys must be imported into the RPM keyring. #TBC How a package issuer signs his package with his private key #TBC dnf reinstall

Linux Package Management with RPM

Table of Contents