Verifying Package Authenticity - Novell LINUX ENTERPRISE SERVER 11 - ADMINISTRATION Administration Manual

TIP: Software Development Packages
For a number of packages, the components needed for software development
(libraries, headers, include files, etc.) have been put into separate packages.
These development packages are only needed if you want to compile software
yourself (for example, the most recent GNOME packages). They can be identified
by the name extension -devel, such as the packages alsa-devel,
gimp-devel, and kdelibs3-devel.

4.2.1 Verifying Package Authenticity

RPM packages have a GnuPG signature. The key including the fingerprint is:
1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>
Key fingerprint = 79C1 79B2 E1C8 20C1 890F
The command rpm --checksig package-1.2.3.rpm can be used to verify
the signature of an RPM package to determine whether it originates from SUSE or from
another trustworthy facility. This is especially recommended for update packages from
the Internet. The SUSE public package signature key normally resides in /root/
.gnupg/. The key is additionally located in the directory /usr/lib/rpm/gnupg/
to enable normal users to verify the signature of RPM packages.
4.2.2 Managing Packages: Install, Update,
and Uninstall
Normally, the installation of an RPM archive is quite simple: rpm -i package.rpm.
With this command the package is installed, but only if its dependencies are fulfilled
and there are no conflicts with other packages. With an error message, rpm requests
those packages that need to be installed to meet dependency requirements. In the
background, the RPM database ensures that no conflicts arise—a specific file can only
belong to one package. By choosing different options, you can force rpm to ignore
these defaults, but this is only for experts. Otherwise, you risk compromising the integrity
of the system and possibly jeopardize the ability to update the system.
The options -U or --upgrade and -F or --freshen can be used to update a
package (for example, rpm -F package.rpm). This command removes the files
9994 A84E DAE8 9C80 0ACA
Managing Software with Command Line Tools 27