0

I recently had a package signing key expire preventing some automatic updates from installing so am now setting up monitoring to make sure we are alerted if this happens again.

On Debian systems I can use apt-key to show all the repo keys and their expiry dates (if any) but cannot find how to do the equivalent for yum on CentOS

I can get some key info using:

rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'

But this does not show expiry dates - any idea how to extract this information?

0

On Red Hat derived systems, the GPG keys are also stored in ASCII armor in the directory /etc/pki/rpm-gpg-keys. You can inspect any of the keys from there.

For example, on CentOS 8:

[root@localhost ~]# gpg /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial 
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2019-05-03 [SC]
      99DB70FAE1D7CE227FB6488205B555B38483C65D
uid           CentOS (CentOS Official Signing Key) <security@centos.org>

You can use -v to see additional details, and you will need to do so on older versions of gpg. This example is from CentOS 7.

[root@localhost ~]# gpg -v /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7 
Version: GnuPG v1.4.5 (GNU/Linux)
pub  4096R/F4A80EB5 2014-06-23 CentOS-7 Key (CentOS 7 Official Signing Key) <security@centos.org>
sig        F4A80EB5 2014-06-23   [selfsig]
gpg: armor header: 

Neither of these have expiry dates, but a key which has an expiry date or is already expired will show the expiry date.

Here is a key with an expiry date in the future:

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2020-01-21 [SC] [expires: 2032-01-18]
      D25402AB23709F67CDF72CBFB413ACAD6275F250
uid           EuroLinux 8 GPG RPM sign key <support@euro-linux.com>
sub   rsa2048 2020-01-21 [E] [expires: 2032-01-18]

And here is a key that already expired:

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2016-05-20 [SC] [expired: 2019-05-20]
      36EBEB08D346B0A85B58E140EE788F495250AEF3
uid           The UnitedRPMs Project (Key for UnitedRPMs infrastructure) <unitedrpms@protonmail.com>
sub   rsa2048 2016-05-20 [E] [expired: 2019-05-20]

An optional package distribution-gpg-keys contains GPG keys from a variety of different Linux distributions and repositories. When this package is installed, these keys are available in the directory /usr/share/distribution-gpg-keys.

| improve this answer | |
  • Perfect. I then can use gpg --with-colons to get all the info separated into fields for easy parsing the same as I am doing with apt-key, just couldn't find where the keys were stored on CentOS! Thanks for your help – Jon Reeves Oct 15 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.