Chapter 6. RPMs

Procedure 6.1. Creating a GPG Key

1. Make a directory for creating the key:

   mkdir -p ~/.gnupg
   

   Copy to Clipboard Toggle word wrap
2. Generate the key pair:

   gpg --gen-key
   

   Copy to Clipboard Toggle word wrap
   You will need to select the kind of key, the keysize, and how long the key should be valid for (press enter to accept the default values). You will also need to specify a name, comment, and email address:

   Real name: rpmbuild
   Email address: rpmbuild@example.com
   Comment: this is a comment
   You selected this USER-ID:
       "rpmbuild (this is a comment) <rpmbuild@example.com>"
   
   Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?
   

   Copy to Clipboard Toggle word wrap
   Press O to accept the details and continue.
3. List all keys with their fingerprints:

   gpg --list-keys --fingerprint
   

   Copy to Clipboard Toggle word wrap
4. Export the keys:

   gpg --export --armor "rpmbuild <rpmbuild@example.com>" > EXAMPLE-RPM-GPG-KEY
   

   Copy to Clipboard Toggle word wrap
5. Import the key to the RPM database to allow RPM origin and integrity verification by running the gpg --import as root on all target systems:

   rpm --import EXAMPLE-RPM-GPG-KEY
   

   Copy to Clipboard Toggle word wrap
   This will occur automatically during client installations, and should not need to be run manually.
6. Once an RPM has been created it can be signed with the GPG key and uploaded to the correct channel:

   rpm --resign package.rpm
   rhnpush --server=http[s]://satellite.server/APP package.rpm --channel=custom-channel-name

   Copy to Clipboard Toggle word wrap
7. To verify an RPM package, navigate to the directory that contains the package, and run the following commands:

   rpm –qip package.rpm
   rpm -K package.rpm

   Copy to Clipboard Toggle word wrap

Procedure 6.2. Building RPMs

1. Create a non-privileged user account called rpmbuild for building packages. This will allow several administrators to share the build environment and the GPG key.
2. In the home directory for the rpmbuild user, /home/rpmbuild, create a file called .rpmmacros:

   touch /home/rpmbuild/.rpmmacros
   

   Copy to Clipboard Toggle word wrap
3. Open the .rpmmacros file in your preferred text editor, and add the following lines. The _gpg_name must match the name for the GPG key used for signing RPMs:

   %_topdir            %(echo $HOME)/rpmbuild
   %_signature         %gpg
   %_gpg_name          rpmbuild <rpmbuild@example.com>
   

   Copy to Clipboard Toggle word wrap
   The directory listing for the defined top level directory (/home/rpmbuild/rpmbuild in the example above) must have the same directory layout that is present under /usr/src/redhat.