.\" Generated by scdoc 1.11.5
.\" Complete documentation for this program is not available as a GNU info page
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.nh
.ad l
.\" Begin generated content:
.TH "RPMKEYS" "8" "2026\-10\-04" "RPM 6.1.0"
.PP
.SH NAME
.PP
rpmkeys \- RPM Keyring
.PP
.SH SYNOPSIS
.PP
\fBrpmkeys\fR {\fB\-K\fR|\fB\-\-checksig\fR} [options] \fIPACKAGE_FILE\fR .\&.\&.\&
.PP
\fBrpmkeys\fR {\fB\-d\fR|\fB\-\-delete\fR|\fB\-e\fR|\fB\-\-erase\fR} [options] \fIFINGERPRINT\fR .\&.\&.\&
.PP
\fBrpmkeys\fR {\fB\-x\fR|\fB\-\-export\fR} [options] [\fIFINGERPRINT\fR .\&.\&.\&]
.PP
\fBrpmkeys\fR {\fB\-i\fR|\fB\-\-import\fR} [options] \fIPUBKEY\fR .\&.\&.\&
.PP
\fBrpmkeys\fR {\fB\-l\fR|\fB\-\-list\fR} [options] [\fIFINGERPRINT\fR .\&.\&.\&]
.PP
\fBrpmkeys\fR \fB\-\-rebuild\fR [options] [rebuild\-options]
.PP
.SH DESCRIPTION
.PP
\fBrpmkeys\fR is used for manipulating the \fBrpm\fR keyring and verifying
package digital signatures with the contained keys.\&
.PP
For all available operations, see \fBOPERATIONS\fR.\&
.PP
.SH OPERATIONS
.PP
\fB\-K\fR,
\fB\-\-checksig\fR
.RS 4
Verify the digests and signatures contained in \fIPACKAGE_FILE\fR to
ensure the integrity and origin of the package.\& See \fBVERIFICATION
POLICY\fR for details of operation.\&
.PP
.RE
\fB\-d\fR,
\fB\-\-delete\fR,
\fB\-e\fR,
\fB\-\-erase\fR
.RS 4
Erase the key(s) designated by \fIFINGERPRINT\fR.\&
The \fB\-\-delete\fR and \fB\-d\fR options are deprecated.\&
.PP
.RE
\fB\-x\fR,
\fB\-\-export\fR
.RS 4
Output the key(s) designated by \fIFINGERPRINT\fR using an ASCII\-armor
encoding.\&  If \fIFINGERPRINT\fR is not specified, output all keys.\&
.PP
.RE
\fB\-\-import\fR
.RS 4
Import ASCII\-armored public keys.\&
Digital signatures cannot be verified without the corresponding
public key (aka certificate).\&
.PP
.RE
\fB\-l\fR,
\fB\-\-list\fR
.RS 4
List currently imported public key(s) (aka certificates) by their
fingerprint and user ID.\& If no fingerprints are specified, list all
keys.\&
.PP
.RE
\fB\-\-rebuild\fR
.RS 4
Recreate the public key storage.\& Update to the latest format and drop
unreadable keys.\&
.PP
.RE
.SH ARGUMENTS
.PP
\fIFINGERPRINT\fR
.RS 4
The handle used for all operations on the keys.\&
.RE
\fIPACKAGE_FILE\fR
.RS 4
An \fBrpm\fR package file or a manifest.\&
.RE
\fIPUBKEY\fR
.RS 4
An ASCII\-armored OpenPGP public key (aka certificate).\&
.PP
.RE
.SH OPTIONS
.PP
See \fBrpm\-common\fR(8) for the options common to all \fBrpm\fR executables.\&
.PP
.SH REBUILD OPTIONS
.PP
\fB\-\-from\fR <\fBfs\fR|\fBopenpgp\fR|\fBrpmdb\fR>
.RS 4
Use the keys from the specified backend to rebuild the currently
configured keystore backend.\&
This can be used to convert from one key storage to another.\&
.PP
.RE
.SH VERIFICATION POLICY
.PP
To deal with three generations of package formats and as many decades of
cryptographic algorithms and differing system policies, the RPM package
verification is a complicated system with many moving parts.\&
.PP
RPM packages contain multiple individual \fIverifiables\fR that cover different
parts of the package: header, payload or both.\& There are two \fIclasses\fR of
verifiables: digests and signatures.\& Each verifiable may use a different
cryptographic \fIalgorithm\fR.\& A class\-level verification result (pass or fail) is
computed based on the results from its individual verifiables.\& When a class or
verifiable passes, it is also said to \fIverify\fR.\&
.PP
For a class to verify, both the header and payload must be covered by a passing
verifiable.\& Non\-trusted signatures (such as expired, or ones using legacy
algorithms) are ignored on the individual level, so they only cause a
class\-level failure if no passing signature is present.\&
.PP
An outright failure of an individual verifiable typically fails the whole class
as well, but some verifiables have \fIalternatives\fR where either of the
verifiables passing is sufficient and nullifies the other one failing.\&
.PP
The final verification result is computed based on the class results, and the
package verification mode set with the \fB%_pkgverify_level\fR macro (see
\fBrpm\-config\fR(5) for details).\&
.PP
Which of the individual verifiables are used depends on the system cryptography
libraries and their policies, RPM configuration and the package format version.\&
.PP
.SH OUTPUT
\fB\-\-checksig\fR
.nf
.RS 4
<_PACKAGE_FILE_>: [<digests|DIGESTS>] [<signatures|SIGNATURES>] <OK|NOT OK>
.fi
.RE
.PP
.RS 4
The output is on the level of digest and signature class, which
often includes results from multiple individual verifiables.\&
Classes that verify are printed in lowercase, failing classes
in UPPERCASE.\& The final package level conclusion per current
\fBVERIFICATION POLICY\fR is printed out as \fBOK\fR or \fBNOT OK\fR.\&
.PP
.RE
\fB\-\-list\fR
.nf
.RS 4
<fingerprint> <name> <userid> public key
.fi
.RE
.PP
.SH TROUBLESHOOTING
.PP
Use \fB\-\-checksig \-\-verbose\fR to troubleshoot verification on per\-veriable level.\&
.PP
See \fBVERIFICATION POLICY\fR for background on interpreting the output.\&
The per\-class results and the final conclusion are not printed at all in
this mode.\& One should not attempt to calculate the final result from
this output.\&
.PP
.nf
.RS 4
<_PACKAGE_FILE_>:
    <range> <description> [ALT] <class>: <result>
    \&.\&.\&.
.fi
.RE
.PP
.RS 4
The output is on the level of individual verifiables.\&
.PP
Range describes the area which the verifiable covers.\& Possible
values are:
.PD 0
.IP \(bu 4
\fBHeader\fR: The main header of the package
.IP \(bu 4
\fBPayload\fR: The payload of the package
.IP \(bu 4
\fBLegacy\fR: The main header and the payload of the package
.PD
.PP
Description includes general information about this verifiable.\&
For digests, this is just the hash algorithm name, such as \fBSHA256\fR.\&
Signatures are prefixed with \fBOpenPGP\fR.\&
For discovered signatures, the rest of the description is one of the
following, depending on whether the public key is available or not:
.PP
.nf
.RS 4
<version> <sign_algo>/<hash_algo>, key fingerprint <fprint>
<version> <sign_algo>/<hash_algo>, key ID <id>
.fi
.RE
.PP
Note that the version is OpenPGP version, not to be confused with
similar looking RPM signature versions.\&
For non\-present signatures such details are not available, but
for RPM V3 and V4 signatures the "algorithm family" (\fBRSA\fR or \fBDSA\fR)
is emitted.\& RPM V6 signatures may use arbitrary OpenPGP algorithms.\&
.PP
\fBALT\fR indicates the verifiable is an optional alternative to another
verifiable.\&
.PP
Class is one of \fBdigest\fR or \fBsignature\fR.\&
.PP
Result is one of the following:
.PD 0
.IP \(bu 4
\fBOK\fR: Verification passed.\&
.IP \(bu 4
\fBNOKEY\fR: The public key is not available (signatures only).\&
.IP \(bu 4
\fBNOTTRUSTED\fR: Verifiable is not trusted, eg.\& expired key or a legacy
algorithm (signatures only).\& Does not necessarily indicate class
failure if there are other usable signatures present.\&
.IP \(bu 4
\fBNOTFOUND\fR: Verifiable was not found.\& Only emitted on class\-level
failure, and indicates which individual verifiables RPM looked for.\&
.IP \(bu 4
\fBBAD\fR: Verification failed.\&
.PD
.PP
.PP
.RE
.SH CONFIGURATION
.PP
There are several configurables affecting the behavior of this
verification, see \fBrpm\-config\fR(5) for details:
.PD 0
.IP \(bu 4
\fB%_keyring\fR
.IP \(bu 4
\fB%_keyringpath\fR
.IP \(bu 4
\fB%_pkgverify_flags\fR
.IP \(bu 4
\fB%_pkgverify_level\fR
.PD
.PP
.SH EXIT STATUS
On success, \fB0\fR is returned.\& In particular, for verification it means all
arguments were verified successfully as per current \fBVERIFICATION POLICY\fR.\&
.PP
A non\-zero code indicates the number of failures encountered, but this
is capped to \fB254\fR to avoid overflowing the return.\& \fB255\fR is returned on
output error, this special code is used by \fBxargs\fR(1) to stop processing
immediately.\&
.PP
.SH EXAMPLES
.PP
\fBrpmkeys \-\-export 771b18d3d7baa28734333c424344591e1964c5fc | sq inspect\fR
.RS 4
Export key 771b18d3d7baa28734333c424344591e1964c5fc for inspecting
with sequoia\-sq.\&
.PP
.RE
\fBrpmkeys \-\-erase 771b18d3d7baa28734333c424344591e1964c5fc\fR
.RS 4
Erase key 771b18d3d7baa28734333c424344591e1964c5fc from the keyring.\&
.PP
.RE
\fBrpmkeys \-K hello\-2.\&0\-1.\&x86_64.\&rpm\fR
.RS 4
Verify hello\-2.\&0\-1.\&x86_64.\&rpm package file.\&
.PP
.RE
.SH SEE ALSO
\fBpopt\fR(3), \fBrpm\fR(8), \fBrpm\-common\fR(8), \fBrpm\-config\fR(5), \fBrpmsign\fR(1)
.PP
\fBrpmkeys \-\-help\fR \- as \fBrpm\fR(8) supports customizing the options via popt
aliases it'\&s impossible to guarantee that what'\&s described in the
manual matches what'\&s available.\&
.PP
\fBhttp://www.\&rpm.\&org/\fR