I'm attempting to upgrade curl on RHEL / CentOS machines. I've found what seems to be the appropriate source packages in a number of repos. (ie, http://mirror.centos.org/centos/6/os/SRPMS/Packages/curl-7.19.7-16.el6.src.rpm)

When attempting to make an rpm from the source package using rpmbuild, I get the following output;

# rpmbuild --rebuild curl-7.19.7-16.el6.src.rpm
Installing curl-7.19.7-16.el6.src.rpm
warning: InstallSourcePackage: Header V3 RSA/SHA256 signature: NOKEY, key ID c105b9de
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
error: unpacking of archive failed on file /usr/src/redhat/SOURCES/curl-7.15.3-multilib.patch;4e984633: cpio: MD5 sum mismatch
error: curl-7.19.7-16.el6.src.rpm cannot be installed

The issue seems to be that the source is meant for Fedora, which uses SHA-256. There's a bug filed here that has comments indicating there's a means to circumvent the md5 checksum. However, it's not very detailed.

Is there a way to install this package?

4 Answers 4


I assume you want to upgrade CentOS5 curl to a version from CentOS6. I think the problem is not with SHA256 signature but with XZ/LZMA compression which is not supported by CentOS5.

You'd need to:

  • run CentOS6 on a spare computer or virtual machine — LiveCD is enough
  • on CentOS6: yum install rpm-build yum-utils
  • on CentOS6: yumdownloader --source curl
  • on CentOS6: rpm -i curl-*.src.rpm
  • on CentOS6: scp -pr ~/rpmbuild your_username@your_centos_ip:
  • on CentOS5: rpmbuild -ba ~/rpmbuild/SPECS/curl.spec

If you don't have a CentOS 6 box available as @Tometzky suggests, this will work :

cd ~/rpmbuild/SOURCES
rpm2cpio ~/path/to/your/curl-*.src.rpm | cpio -idmv
mv *.spec ~/rpmbuild/SPECS/
rpmbuild -ba ~/rpmbuild/SPECS/curl.spec

Unfortunately, rebuilding curl from CentOS 6 on CentOS 5 involves a lot more complexity beyond just this first hurdle including :

  • Rebuliding libssh2 from CentOS 6 on CentOS 5
  • Installing lzma
  • Other things I haven't figured out yet


rpmbuild --rebuild --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" curl-7.19.7-16.el6.src.rpm

If that doesn't work, you may need to extract the RPM and then rebuild it:

rpm -i --nomd5 curl-7.19.7-16.el6.src.rpm
rpmbuild -ba --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" /usr/src/redhat/SPECS/curl.spec

I may have the spec file name wrong on the last command.


I think you are talking about this bug: https://bugzilla.redhat.com/show_bug.cgi?id=490613#c15

FYI: The SRPMs that contain rpm with back-ported strong hashes + xz payload support are available from the Fedora Infrastructure repositories:


I've been using those for a very long time on my builders and they work nicely. It would be great if they were officially accepted into RHEL5.

you want rpm-4.6.0-4.0.notting.1.el5

src.rpm or binaries are in :




Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.