24.6. Signing custom built packages

Procedure

1. Use rpmsign –signfiles to sign package files:

   # rpmsign --define "gpg_name _<GPG_KEY_NAME>" --addsign --signfiles --fskpass --fskpath=<PATH_TO_YOUR_PRIVATE_IMA_CODE_SIGNING_KEY> <PATH_TO_YOUR_RPM>

   --define "gpg_name _<GPG_KEY_NAME>"

   The GPG key signs the package, and the IMA code signing key signs each file in the package.

   --addsign

   Adds the signature to the package.

   --signfiles

   Signs each file in the package.

   --fskpass

   Avoids repeatedly entering the password for the IMA code signing key.

   --fskpath

   Specifies the path to the IMA code signing key.