Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

3.2. Digital Signatures for RHN Packages

All packages distributed through RHN should have a digital signature. A digital signature is created with a unique private key and can be verified with the corresponding public key. After creating a package, the SRPM (Source RPM) and the RPM can be digitally signed with a GnuPG key. Before the package is installed, the public key is used to verify the package was signed by a trusted party and the package has not changed since it was signed.

3.2.1. Generating a GnuPG Keypair
リンクのコピー

A GnuPG keypair consists of the private and public keys. To generate a keypair type the following command as the root user on the shell prompt: 
gpg --gen-key
Copy to Clipboard Toggle word wrap
If you execute this command as a non-root user, you see the following message: 
gpg: Warning: using insecure memory!
Copy to Clipboard Toggle word wrap
This message appears because non-root users cannot lock memory pages. Since you do not want anyone else to have your private GnuPG key or your passphrase, you want to generate the keypair as root. The root user can lock memory pages, which means the information is never written to disk.
After executing the command to generate a keypair, you see an introductory screen containing key options similar to the following: 
	gpg (GnuPG) 1.2.6; Copyright (C) 2004 Free Software
	Foundation, Inc.  This program comes with ABSOLUTELY NO
	WARRANTY. This is free software, and you are welcome to
	redistribute it under certain conditions. See the file COPYING
	for details. Please select what kind of key you want: (1) DSA
	and ElGamal (default) (2) DSA (sign only) (4) RSA (sign only)
	Your selection?
Copy to Clipboard Toggle word wrap
Accept the default option: (1) DSA and ElGamal. This option allows you to create a digital signature and encrypt/decrypt with two types of technologies. Type 1 and then press Enter.
Next, choose the key size, which is how long the key should be. The longer the key, the more resistant against attacks your messages are. Creating a key of at least 1024 bits in size is recommended.
The next option asks you to specify how long you want your key to be valid. If you do choose an expiration date, remember that anyone who is using your public key must also be informed of its expiration and supplied with a new public key. It is recommended that you select no expiration date. If you do not choose an expiration date, you are asked to confirm your decision: 
Key does not expire at all Is this correct (y/n)?
Copy to Clipboard Toggle word wrap
Press y to confirm your decision.
Your next task is to provide a User-ID containing your name, your email address, and an optional comment. Each is requested individually. When you are finished, you are presented with a summary of the information you entered.
Once you accept your choices, you enter a passphrase.

Note

Like your account passwords, a good passphrase is essential for optimal security in GnuPG. Mix your passphrase with uppercase and lowercase letters, use numbers, and/or include punctuation marks.
Once you enter and verify your passphrase, your keys are generated. A message similar to the following appears: 
We need to generate a lot of random bytes. It is a good idea to perform some
other action (type on the keyboard, move the mouse, utilize the disks) 
during the prime generation; this gives the random number generator a 
better chance to gain enough entropy. 

+++++.+++++.++++++++....++++++++++..+++++.+++++.+++++++.+++++++ +++.
++++++++++++++++++++++++++++++++++++++..........................++++
Copy to Clipboard Toggle word wrap
When the activity on the screen ceases, your new keys are placed in the directory .gnupg in root's home directory. This location is because you are ran the command as root. To list your root keys, use the command: 
gpg --list-keys
Copy to Clipboard Toggle word wrap
The output is similar to the following: 
/root/.gnupg/pubring.gpg ----------------  pub 1024D/B7085C8A 2002-02-18
 Your Name<you@example.com> 
sub 1024g/E12AF9C4 2002-02-18
Copy to Clipboard Toggle word wrap
To retrieve your public key, use the following command: 
gpg --export -a 'Your Name' > public_key.txt
Copy to Clipboard Toggle word wrap
Your public key is written to the file public_key.txt.
This public key is quite important. It's the key that must be deployed to all client systems that receive custom software through up2date. Techniques for deploying this key across an organization are covered in the Red Hat Network Client Configuration Guide.
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat