rpmkeys(8)
Manage GPG keys used for RPM package signature verification.
Synopsis
rpmkeys [OPTION]... [KEY]...Description
The rpmkeys command manages GPG public keys stored in the RPM keyring, which are used to verify the authenticity and integrity of RPM packages. These keys validate package signatures created by package maintainers, ensuring packages haven't been tampered with or spoofed.
Keys are typically imported into the system keyring (usually /etc/pki/rpm-gpg/) and registered with RPM so that package installation and verification operations can automatically check signatures against trusted keys.
Common options
| Flag | What it does |
|---|---|
--import | Import a GPG public key from a file into the RPM keyring |
--list-keys | Display all keys currently in the RPM keyring |
--delete-keys | Remove a key from the RPM keyring by key ID |
-v, --verbose | Print detailed information during key operations |
--root ROOT | Specify alternate root directory for RPM operations |
--dbpath DBPATH | Use alternate RPM database path instead of default |
--keyring KEYRING | Specify alternate GPG keyring file to use |
-h, --help | Display help message and exit |
Examples
Import Red Hat's official GPG key into the RPM keyring for signature verification
rpmkeys --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-releaseDisplay all GPG public keys currently trusted by RPM
rpmkeys --list-keysImport a custom GPG public key from a user's home directory
rpmkeys --import ~/custom-key.ascRemove the key with ID 3DB8B0AD from the RPM keyring
rpmkeys --delete-keys 3DB8B0ADImport all GPG keys from the standard Red Hat GPG key directory (alternative using rpm command)
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-*Import a vendor signing key with verbose output showing details of the operation
rpmkeys -v --import ./vendor-signing-key.gpg