OS version: RHEL 8.9

rpm -iv --prefix /dir /filePath

rpm error:

tag[42]: BAD, tag 1096 type 5 offset 2232 count 16 len 64

What does error mean and how to solve this?

New contributor
Zen is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    Is this happen with specific rpm file or with every rpm? Commented Jun 9 at 10:59
  • happens with every rpm file
    – Zen
    Commented Jun 9 at 14:26
  • Have you try to rebuild the rpm database? Commented Jun 9 at 19:28

1 Answer 1


Tests in rpm source code indicate this "BAD" output can come from a corrupted header. Specifically chopping off some bytes off the front with dd if=/dev/zero of="${RPMTEST}"/tmp/${pkg} conv=notrunc bs=1 seek=4750 count=4 2> /dev/null has expected output containing tag[[13]]: BAD, tag 1028 type 0 offset 116 count 5 len 7

Whatever exactly caused your problem, be sure rpm's public keys are correct. At this point, I am unsure if your public keys or packages are corrupt.

What is the correct gpg-pubkey for Red Hat Enterprise Linux server? KB article notes that rpm can list its public keys with rpm -qa gpg* A bit unusually, the rpm "version" of a gpg-pubkey is its key ID. Further, you can have gpg list the full finger print of all rpm installed public keys:

for entry in $(rpm -qa gpg-pubkey*); do gpg --quiet --dry-run --import --import-options show-only --with-fingerprint <(rpm -qa gpg-pubkey* --qf "%{Description}\n"); done

Red Hat will sign their stuff with their package signing keys. Notably since 2010 you can expect fingerprint 567E 347A D004 4ADE 55BA 8A5F 199E 2F91 FD43 1D51 If you use third party repositories, check what their key should be as well.

On that product signing keys page is a reminder of how to verify an rpm file: rpm -v --checksig *.rpm Also run this on the problem rpm files, it might be more informative than encountering a signature error during an install operation. Everything should at least have several digest: OK indicating internal checksums passed. Signed packages should also have OK Signatures.

At this point, you should know all the rpm gpg keys installed, and the keys that signed those rpm files you have. Track down any unknowns, this is important for software integrity. Ask everyone who had privileged access to this host.

Download another copy of the problem rpm, from a known presumed good source. Check its signatures. If it also is bad, its possible the problem affects that copy, not just the local one.

As to operations on rpm packages, use dnf or yum rather than lower level rpm. Higher level tools resolve packages and have a better experience with managing gpg signatures and the like. Consider creating a repo, and a yum.repos.d/*.conf file pointing to it, with baseurl= for downloads and gpgkey= for the key that signs it. dnf commands will prompt to import the key if unknown, and will complain if things do not verify.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .