2

Is it mandatory to sign a RPM? Will not signing the RPM cause any issues in terms of distribution or uploads to a central repository?

1
  • Define "central repository". But no, signing isn't necessary unless you want to be able to validate that the packages are what you expect them to be. Apr 30, 2015 at 21:17

2 Answers 2

1

Signing a package is not mandatory, but it is recommended for integrity verification reasons. If you are developing a package to be included in a large existing repository (e.g. EPEL, RPM Fusion, etc.) then they will sign the package with their key when they publish it.

1
  • They will likely also handle doing the actual building from source for you as well. Apr 30, 2015 at 22:32
0

Recent (for several years) yum configurations require RPMs to be signed, by default. You can of course override the default (disable GPG checking) with the --nogpgcheck option as noted in the Fedora forum. So it is not technically mandatory, but management policies, e.g., customers of Red Hat may forbid the workaround. Red Hat gives support to that in their documentation.

In practice, you can sign any package using your own gpg signature (as detailed in Thomas Chung's blog), and using rpm --addsign. Yum will accept that just as well as any other signature.

Beyond the initial installation, the signature is of interest when verifying a package (checking for changes since it was installed, using rpm -V). Whether a difference is found, if rpm -qi shows an unexpected (or missing) signature, that would demonstrate possible tampering with the package.

If you are installing for yourself alone, these matters are perhaps not very interesting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.