Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to upgrade curl on RHEL / CentOS machines. I've found what seems to be the appropriate source packages in a number of repos. (ie,

When attempting to make an rpm from the source package using rpmbuild, I get the following output;

# rpmbuild --rebuild curl-7.19.7-16.el6.src.rpm
Installing curl-7.19.7-16.el6.src.rpm
warning: InstallSourcePackage: Header V3 RSA/SHA256 signature: NOKEY, key ID c105b9de
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
error: unpacking of archive failed on file /usr/src/redhat/SOURCES/curl-7.15.3-multilib.patch;4e984633: cpio: MD5 sum mismatch
error: curl-7.19.7-16.el6.src.rpm cannot be installed

The issue seems to be that the source is meant for Fedora, which uses SHA-256. There's a bug filed here that has comments indicating there's a means to circumvent the md5 checksum. However, it's not very detailed.

Is there a way to install this package?

share|improve this question

I assume you want to upgrade CentOS5 curl to a version from CentOS6. I think the problem is not with SHA256 signature but with XZ/LZMA compression which is not supported by CentOS5.

You'd need to:

  • run CentOS6 on a spare computer or virtual machine — LiveCD is enough
  • on CentOS6: yum install rpm-build yum-utils
  • on CentOS6: yumdownloader --source curl
  • on CentOS6: rpm -i curl-*.src.rpm
  • on CentOS6: scp -pr ~/rpmbuild your_username@your_centos_ip:
  • on CentOS5: rpmbuild -ba ~/rpmbuild/SPECS/curl.spec
share|improve this answer

If you don't have a CentOS 6 box available as @Tometzky suggests, this will work :

cd ~/rpmbuild/SOURCES
rpm2cpio ~/path/to/your/curl-*.src.rpm | cpio -idmv
mv *.spec ~/rpmbuild/SPECS/
rpmbuild -ba ~/rpmbuild/SPECS/curl.spec

Unfortunately, rebuilding curl from CentOS 6 on CentOS 5 involves a lot more complexity beyond just this first hurdle including :

  • Rebuliding libssh2 from CentOS 6 on CentOS 5
  • Installing lzma
  • Other things I haven't figured out yet
share|improve this answer


rpmbuild --rebuild --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" curl-7.19.7-16.el6.src.rpm

If that doesn't work, you may need to extract the RPM and then rebuild it:

rpm -i --nomd5 curl-7.19.7-16.el6.src.rpm
rpmbuild -ba --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" /usr/src/redhat/SPECS/curl.spec

I may have the spec file name wrong on the last command.

share|improve this answer

I think you are talking about this bug:

FYI: The SRPMs that contain rpm with back-ported strong hashes + xz payload support are available from the Fedora Infrastructure repositories:

I've been using those for a very long time on my builders and they work nicely. It would be great if they were officially accepted into RHEL5.

you want rpm-4.6.0-4.0.notting.1.el5

src.rpm or binaries are in :

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.