Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can rpm be persuaded to import and fetch public keys from an arbitrary pubkey database?

On the same build machine I've got two automated users who each need to verify package signatures from different sources, signed under different keys. If I rpm --import, each user will be able to verify packages intended for the other. I'd rather each user not know about the other's public keyring.

Is there a way I can specify an alternate or supplementary pubkey database on a per-user or per-rpm(8)-invocation basis?

share|improve this question
Can you share the reason that you'd "rather each user not know about the other's public keyring"? – sciurus Aug 31 '12 at 21:57
@sciurus, for separation of concerns. It's a bit safer, since "verifier1" cannot do the work of verifier2, it's a bit easier to understand, since "verifier1" has only one set of keys, and, depending on the implementation, it's more portable, since I'd just need to migrate one user and its associated keys. – pilcrow Sep 4 '12 at 12:43
up vote 1 down vote accepted

Keys reside in the RPM database. Thus, you'd need to maintain 2 separate rpm databases. For example:

mkdir /var/lib/rpm_a; cp -p /var/lib/rpm/__db.* /var/lib/rpm_a/

Then add --dbpath /var/lib/rpm_a to your rpm command or add to ~/.rpmmacros:

_dbpath /var/lib/rpm_a

However, you now have to maintain 2 rpm databases. I would have your automation temporarily copy the system db, add the keys, do your work, then delete the temp db.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.