What is a gpg key and why do i need it?

I get this nagging error when i install a fresh centos vps machine:

GPG key retrieval failed: [Errno 5] OSError: [Errno 2] No such file or directory: '/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL'

1 Answer 1


A key like this is used to sign and verify the packages you are downloading to be sure they are legit.

If the error you describe happens you should be prompted to download a replacement set of keys from the net. If not you can do so by hand.

Strictly speaking these signatures are not necessary - you can still install software as you have seen - but the security of your system is significantly reduced without their use.

  • I don't know about significantly reduced. If you are retrieving the GPG key using from the same source over the same network as the package, it seems just as likely that someone could serve up an invalid key for you to download as they could the package.
    – Zoredache
    Feb 1, 2012 at 18:47
  • @Zoredache - fair enough. My understanding is that the file is downloaded one time and cached, therefore unless the mirror was compromised at the time the new repo started use that would be detected. Sound right to you? Feb 1, 2012 at 19:18
  • 1
    Normally you would get your first key via the installation media, which you would have verified via some other method. The first key will then be used to verify any other keys. If you are talking about 3rd party repos, you would want to verify those using some other method.
    – Zoredache
    Feb 1, 2012 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.