4

Is there a way to remove or replace an existing GPG signature on an RPM?

I am placing a few obscure RPMs on an internal repo we use for supplementary rhel/centos packages. A few of those RPMs are already signed. I would like to remove those signatures and resign them with a GPG signature we use for our local repo.

4

Simply (re-) sign the packages with your own key...

rpm --addsign package.rpm

The --addsign option generates and inserts new signatures for each package. Any existing signatures will be discarded.

The --resign option generates and appends signatures for the listed packages while preserving the existing signatures.

If you had imported the public key you can validate the new signature

rpm --checksig -v package.rpm

You should see the phrase Good signature from "Your Name" in the output.

AFAIK removing signatures isn't supported.

  • 1
    slight clarification for --resign, it will force resign if a key with the same sig exists or does not exist, and for --addsign, existing signatures are not automatically discarded if the signature you're trying to sign with is the same (or even different it seems) from the existing signature, i.e. --resign is basically the equivalent of force sign and overwrite any existing signatures. – sabujp Oct 23 '17 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.