I wanted to install a package on CentOS 6 via
rpm (e.g., the current
EDIT: Of course I would always prefer the installation via
yum but somehow I failed to get that specific package installed using this normal approach. As such, the EPEL/FAQ recommends below Version 2.
As I'm downloading the package through an insecure channel (http) I wanted to make sure that the integrity of the file is verified using information that is not provided with the downloaded file itself. Is this especially true for all of these approaches?
I've seen various approaches to this on the internet:
rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm
rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm
rpm --import https://fedoraproject.org/static/0608B895.txt
rpm -K epel-release-6-7.noarch.rpm
rpm -i epel-release-6-7.noarch.rpm
I do not know
rpm very well, so I wondered how they might differ? My guess (after reading the manpage) is that
- the first should only be used when the package is previously not installed,
- the second would additionally remove previous versions of the package after installation,
- the first two omit some verification steps before the actual installation that are done by
So my main questions at this point are
- Are my guesses correct or am I missing something?
- Is the
rpm --import ...implicitly done for the first two approaches as well, and if not, isn't it necessary to do so after all?
- Are these additional checks performed by
rpm -K ...any relevant?
- What is the best (most secure, most reliable, most maintainable, ...) way of installing packages via rpm in general?