Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.

I have initially created a signing box that our devs can log on to and sign the rpm's using their GnuPG created key. They then move the signed package to an 'outbox' directory for QA to pick up, and move their public portion of the key to a 'public key' directory. This however is not ideal as multiple (fake) public keys can be made by each user...

The ultimate aim is to force each completed package to be signed by a single developer to ensure accountability and integrity as the package moves to our operations platform.

Therefore, I have a few areas that I need help/suggestions with:

  • What is the best way to ensure only one key is made by each user? (A script maybe?)
  • What is the best way to store and retrieve these keys that ensures integrity?

Many thanks.

share|improve this question

You cannot prevent anybody from creating a new key pair. But you can maintain a list of "allowed key pairs" where you insert only one key pair per developer, and whenever you validate a signed rpm, you use that list as your trust base.

share|improve this answer
Yes, I would agree that it is impossible to fully prevent rogue keypairs from being made. Could you suggest a practical (not by hand) way of maintaining this list of 'allowed keypairs'? Does rpm signature checking have this facility? Regards. – Adam D. Oct 31 '12 at 9:31
see the heading "Using Gpg to Sign Packages" in the rpm man page. %_gpg_path points to the directory with the "authorized" keyring. – Teris Riel Sep 4 '13 at 21:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.