Centos – How to force rpm and yum to fail if a GPG signature is missing or cannot otherwise be verified

centosrhelrpmSecurityyum

How can I force rpm and yum to fail if a GPG signature is missing from a package or otherwise cannot be verified due to a missing key? For the example below, assume the RPM has been signed but the key has not been installed.

With RPM I see a warning, but I would like this to fail so that I am forced to manually install the signing key.

# rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} --> %{summary}\n'
gpg-pubkey-c105b9de-4e0fd3a3 --> gpg(CentOS-6 Key (CentOS 6 Official Signing Key) <centos-6-key@centos.org>)

# rpm -ivh http://yum.example.com/company-release-el-6.noarch.rpm
Retrieving http://yum.example.com/company-release-el-6.noarch.rpm
warning: /var/tmp/rpm-tmp.3VmFk2: Header V4 RSA/SHA1 Signature, key ID 3bd6ec30: NOKEY
Preparing...                ########################################### [100%]
    1:company-release     ########################################### [100%]

With yum, I see no warnings related to the fact that the signing key is not installed.

# yum install -vy http://yum.example.com/company-release-el-6.noarch.rpm

Are there additional flags I can pass to these commands or a configuration setting I can modify to change the behavior? Or must I download the RPM and run rpm --checksig prior to installation?

Best Answer

The main point to understand about GPG checking for packages is that the GPG signature is embedded within the package, and the GPG keys are stored in the rpmdb. There is no secure API to ask "What key is package X signed with" you can only ask "Is package X signed with a key in the rpmdb" and "Does key Y exist in the rpmdb". Also note that this means that a package can only be signed by one key, and that changing the signature changes the packages.

Yum performs a number of steps when it downloads a package from a repository configured with "gpgcheck = 1" (the default).

  1. After the first package from a repository is downloaded, a simple "is this package signed with a known gpgkey" call is done. If it is, nothing is done. If it isn't a warning is displayed to the user. This is purely informational.

  2. Before the transaction starts yum checks that the package is signed with a known gpgkey (one already installed in the rpmdb), if it is the package is valid and no other steps are performed. If not then it continues to #3.

  3. Yum downloads all the files given in the "gpgkey" data for the repository that the package comes from. Yum parses that, ignoring any keys already present in the rpmdb. If there are no new keys, yum will fail.

  4. If there is a "gpgcakey" specified for the repository, then yum will download all the files given in the "gpgcakey" data. Yum parses that, ignoring any keys already present in that repositories gpg keyring. If there are no gpgcakeys installed after parsing the file, yum will fail. If there are new gpgcakeys, then if they are already imported as CA keys for another repo. they are automatically imported. If this is the first tiem we've seen this CA key the user is asked if he wants to install the key (unless -y is given). If he says no to any key, yum fails (although all imported keys stay in the repo. gpg keyring).

  5. If there is at least one valid "gpgcakey", yum will try to download a "gpgkey".asc file. If that doesn't exists, yum moves on to step #6 as though there was no gpgcakey. If it does exist then the "gpgkey" is tested against the "gpgcakey" and if it passes it's added to the rpmdb, if it fails then yum fails (although all imported keys stay in the rpmdb).

  6. If there are new gpgkeys, then the user is asked if he wants to install each key (unless -y is given). If he says no to any key, yum fails.

  7. After installing any new keys, yum again checks the package signature against the gpgkeys in the rpmdb. If this fails, yum fails.

Related Question