Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

6.8. Signing RPM packages

You can sign RPM packages to ensure no third party can alter their content by using either of the following software:

  • Sequoia PGP supports the OpenPGP standard. RPM also uses Sequoia PGP to verify software signatures.
  • GNU Privacy Guard (GnuPG) supports older OpenPGP standard versions, which makes GnuPG more compatible with RHEL 9 and earlier versions.
주의

Starting from version 10.1, RHEL supports OpenPGPv6 and RPMv6 signatures. These signatures are not compatible with earlier versions of RHEL. RPM on these versions ignore such signatures. If a package contains the RPMv4 signature, RPM uses it instead.

However, in RHEL 9.7 and later RHEL 9 versions, you can enable support for OpenPGPv6 and RPMv6 signatures by using the multisig DNF plugin.

6.8.1. Signing RPM packages with GnuPG
링크 복사

You can sign RPM packages by using the GNU Privacy Guard (GnuPG) software.

6.8.1.1. Creating an OpenPGP key for signing packages with GnuPG
링크 복사

To sign an RPM package by using the GNU Privacy Guard (GnuPG) software, you must create an OpenPGP key first.

Prerequisites

  • You have the rpm-sign and pinentry packages installed on your system.

Procedure

  1. Generate an OpenPGP key pair: 

    $ gpg --gen-key

  2. Check the generated key pair: 

    $ gpg --list-keys

  3. Export the public key: 

    $ gpg --export -a '<public_key_name>' > RPM-GPG-KEY-pmanager

6.8.1.2. Configuring RPM to sign a package with GnuPG
링크 복사

To sign an RPM package by using the GNU Privacy Guard (GnuPG) software, you must configure RPM by specifying the %_gpg_name RPM macro.

Prerequisites

Procedure

  • Define the %_gpg_name macro in your $HOME/.rpmmacros directory: 

    %_gpg_name <key_ID>

    A valid key ID value for GnuPG can be a key fingerprint, full name, or email address you provided when creating the key.

6.8.1.3. Adding a signature to an RPM package
링크 복사

Packages are commonly built without signatures. You can add your signature before the package is released.

Prerequisites

Procedure

  • Add a signature to a package: 

    $ rpmsign --addsign <package-name>.rpm

Verification

  1. Import the exported OpenPGP public key into the RPM keyring: 

    # rpmkeys --import RPM-GPG-KEY-pmanager

  2. Display the key ID with GnuPG: 

    $ gpg --list-keys
[...]
pub   rsa3072 2025-05-13 [SC] [expires: 2028-05-12]
      A8AF1C39AC67A1501450734F6DE8FC866DE0394D
[...]

    The key ID is the 40-character string in the command output, for example, A8AF1C39AC67A1501450734F6DE8FC866DE0394D.

  3. Verify that the RPM file has the corresponding signature: 

    $ rpm -Kv <package_name>.rpm
<package_name>.rpm:
    Header V4 RSA/SHA256 Signature, key ID 6de0394d: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

    The signature key ID matches the last part of the OpenPGP key ID.

6.8.2. Signing RPM packages with Sequoia PGP
링크 복사

You can use Sequoia PGP to sign RPM packages and ensure no third party can alter their content.

6.8.2.1. Creating an OpenPGP key for signing packages with Sequoia PGP
링크 복사

To sign packages by using the Sequoia PGP software, you must create an OpenPGP key first.

Procedure

  1. Install the Sequoia PGP tools: 

    # dnf install sequoia-sq

  2. Generate an OpenPGP key pair: 

    $ sq key generate --own-key --userid <key_name>

  3. Check the generated key pair: 

    $ sq key list

  4. Export the public key: 

    $ sq cert export --cert-userid '<key_name>' > RPM-PGP-KEY-pmanager

6.8.2.2. Configuring RPM to sign a package with Sequoia PGP
링크 복사

To sign an RPM package with the Sequoia PGP software, you must configure the RPM to use Sequoia PGP and specify the %_gpg_name macro.

Prerequisites

  • You have the rpm-sign package installed on your system.

Procedure

  1. Copy the macros.rpmsign-sequoia file to the /etc/rpm directory: 

    # cp /usr/share/doc/rpm/macros.rpmsign-sequoia /etc/rpm/

  2. Get a valid OpenPGP key fingerprint value from the output of key listing: 

    $ sq cert list --cert-userid '<key_name>'
 - 7E4B52101EB3DB08967A1E5EB595D12FDA65BA50
   - created 2025-05-13 10:33:29 UTC
   - will expire 2028-05-13T03:59:50Z

   - [    ✓    ] <key_name>

    The key fingerprint is a 40-character string on the first line of the output, for example, 7E4B52101EB3DB08967A1E5EB595D12FDA65BA50.

  3. Define the %_gpg_name macro in your $HOME/.rpmmacros file as follows: 

    %_gpg_name <key_fingerprint>

    Note that you can also use the full key ID instead of the fingerprint.

    참고

    Unlike GnuPG, Sequoia PGP accepts only the full key ID or fingerprint.

6.8.2.3. Adding a signature to an RPM package
링크 복사

Packages are commonly built without signatures. You can add your signature before the package is released.

Prerequisites

Procedure

  • Add a signature to a package: 

    $ rpmsign --addsign <package-name>.rpm

Verification

  1. Import the exported OpenPGP public key into the RPM keyring: 

    # rpmkeys --import RPM-PGP-KEY-pmanager

  2. Display the key fingerprint of the signing key: 

    $ sq key list --cert-userid <key_name>
 - 7E4B52101EB3DB08967A1E5EB595D12FDA65BA50
   - user ID: <key_name> (authenticated)
   - created 2025-05-13 10:33:29 UTC
   - will expire 2028-05-13T03:59:50Z
   - usable for signing
   - @softkeys/7E4B52101EB3DB08967A1E5EB595D12FDA65BA50: available, unlocked

   - 78E56DD2E12E02CFEEA27F8B9FE57972D6BCEA6F
     - created 2025-05-13 10:33:29 UTC
     - will expire 2028-05-13T03:59:50Z
     - usable for decryption
     - @softkeys/7E4B52101EB3DB08967A1E5EB595D12FDA65BA50: available, unlocked
   - C06E45F8ABC3E59F44A9E811578DDDB66422E345
     - created 2025-05-13 10:33:29 UTC
     - will expire 2028-05-13T03:59:50Z
     - usable for signing
     - @softkeys/7E4B52101EB3DB08967A1E5EB595D12FDA65BA50: available, unlocked
   - E0BD231AB350AD6802D44C0A270E79FFC39C3B25
     - created 2025-05-13 10:33:29 UTC
     - will expire 2028-05-13T03:59:50Z
     - usable for signing
     - @softkeys/7E4B52101EB3DB08967A1E5EB595D12FDA65BA50: available, unlocked

    The key fingerprint is usually a signing subkey in the sq key list --cert-userid <key_name> command output, for example, E0BD231AB350AD6802D44C0A270E79FFC39C3B25.

  3. Verify that the RPM file has the corresponding signature, for example: 

    $ rpm -Kv <package_name>.rpm
<package_name>.rpm:
    Header V4 EdDSA/SHA512 Signature, key ID c39c3b25: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

    The signature key ID matches the last part of the key fingerprint.

6.8.3. Signing RPM packages with Sequoia PGP by using PQC
링크 복사

Post-quantum cryptography (PQC) is a set of algorithms designed to withstand attacks from quantum computers, thereby enhancing software security. To sign a package with PQC algorithms, you can use Sequoia PGP software.

The RPM package manager uses the OpenPGP standard to sign packages. OpenPGPv6 introduces support for hybrid keys and signatures. They combine the current cryptographic algorithm with the PQC algorithm, preventing a single point of failure and increasing trust in the resulting signature.

Starting from version 10.1, RHEL supports RPMv6 signatures. With this format, you can add multiple OpenPGP signatures to a package, increasing the redundancy on the RPM level.

You can combine both RPMv4 and RPMv6 signatures to sign the package. With this feature, you can use different RPM versions to verify the same signature. Starting from RHEL 10.1, RPM verifies only the RPMv6 signatures, if such exist, and ignores the RPMv4 ones. If no RPMv6 signatures are present in the package, RPM uses the RPMv4 signatures. In earlier RHEL versions, RPM verifies RPMv4 signatures and ignores RPMv6 ones.

6.8.3.1. Creating a PQC key
링크 복사

To sign packages by using post-quantum cryptography (PQC) algorithms, you must create a hybrid key pair with Sequoia PGP first.

Note that you can specify different PQC algorithms. For example, the following procedure uses the ML-DSA-87-Ed448 algorithm.

Procedure

  1. Install the Sequoia PGP tools: 

    # dnf install sequoia-sq

  2. Generate an OpenPGP key pair: 

    $ sq key generate --own-key --expiration=never \ --cannot-authenticate --cannot-encrypt \ --email <vendor_email> --name "<vendor_name>" \ --cipher-suite mldsa87 --profile rfc9580

    Replace <vendor_email> and <vendor_name> with the email and the name of the software vendor that provides the RPM package.

    This command generates a primary key and a signing subkey.

  3. Check the generated key pair: 

    $ sq key list --cert-email <vendor_email>
     
     - <ml_dsa_fingerprint>
   - user IDs:
     - <vendor_email> (authenticated)
     - <vendor_name> (authenticated)
   - created 2025-10-03 14:36:44 UTC
   - usable for signing
   - @softkeys/<ml_dsa_fingerprint>: available, unlocked

   - <subkey_fingerprint>
     - created 2025-10-03 14:36:44 UTC
     - usable for signing
     - @softkeys/<subkey_fingerprint>: available, unlocked

  4. Export the PQC OpenPGP certificate: 

    $ sq cert export --cert-email '<vendor_email>' > RPM-PGP-KEY-VENDOR

Next steps

6.8.3.2. Configuring RPM for PQC
링크 복사

After you generate a PQC key you want to use to sign a package, you must configure RPM to use this key.

Configure RPM outside of the build system on a separate signing server. RPM requires macros to support signing packages with Sequoia PGP. These macros are available in a template file.

Prerequisites

  • You created a PQC key pair. For more information, see Creating a PQC key.
  • You have the rpm-sign package installed on your system.

Procedure

  1. Copy the macros.rpmsign-sequoia file to the /etc/rpm directory: 

    # cp /usr/share/doc/rpm/macros.rpmsign-sequoia /etc/rpm/

  2. Check the generated key pair: 

    $ sq key list --cert-email <vendor_email>
     
     - <ml_dsa_fingerprint>
   - user IDs:
     - <vendor_email> (authenticated)
     - <vendor_name> (authenticated)
   - created 2025-10-03 14:36:44 UTC
   - usable for signing
   - @softkeys/<ml_dsa_fingerprint>: available, unlocked

   - <subkey_fingerprint>
     - created 2025-10-03 14:36:44 UTC
     - usable for signing
     - @softkeys/<subkey_fingerprint>: available, unlocked

  3. Export the key fingerprint to the ~/.rpmmacros file: 

    $ echo "%_gpg_name <ml_dsa_fingerprint>" > ~/.rpmmacros

Next steps

6.8.3.3. Adding multiple signatures to an RPM
링크 복사

Starting from version 10.1, RHEL supports RPMv6 signatures. With this format, you can add multiple signatures to an RPM package. This results in enhanced security if either of the keys gets compromised or either of the cryptographic algorithms is rendered insecure.

You can run the rpmsign --addsign --rpmv6 command multiple times to sign the RPM with multiple different keys. Note that the first RPMv6 signature, usually generated with an OpenPGPv4 RSA key and compatible with the RPMv4, is also stored as an RPMv4 signature. This allows older RPM versions to trust the package signature.

중요

Always consider adding an RPMv4-compatible signature to the package before adding any RPMv6 signatures that use PQC algorithms. This ensures that the package has a signature that RPM on RHEL versions earlier than RHEL 10.1 can verify.

Prerequisites

Procedure

  1. Add a signature to a package: 

    $ rpmsign --addsign --rpmv6 <package_name>.rpm
  2. To sign the package with multiple RPMv6 signatures, repeat the first step.

Verification

  1. Import the exported PQC OpenPGP certificate into the RPM keyring: 

    # rpmkeys --import RPM-PGP-KEY-VENDOR

  2. Verify that the RPM file has the corresponding signatures, for example: 

    $ rpmkeys -Kv <package_name>.rpm
     
    <package_name>.rpm:
    Header OpenPGP V6 ML-DSA-87+Ed448/SHA512 signature, key fingerprint: <ml_dsa_fingerprint>: OK
    Header OpenPGP V4 RSA/SHA512 signature, key fingerprint: <rsa_fingerprint>: OK
    Header SHA256 digest: OK
    Payload SHA256 digest: OK
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat맨 위로 이동