I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.

I have initially created a signing box that our devs can log on to and sign the rpm's using their GnuPG created key. They then move the signed package to an 'outbox' directory for QA to pick up, and move their public portion of the key to a 'public key' directory. This however is not ideal as multiple (fake) public keys can be made by each user...

The ultimate aim is to force each completed package to be signed by a single developer to ensure accountability and integrity as the package moves to our operations platform.

Therefore, I have a few areas that I need help/suggestions with:

  • What is the best way to ensure only one key is made by each user? (A script maybe?)
  • What is the best way to store and retrieve these keys that ensures integrity?

Many thanks.


You cannot prevent anybody from creating a new key pair. But you can maintain a list of "allowed key pairs" where you insert only one key pair per developer, and whenever you validate a signed rpm, you use that list as your trust base.

  • Yes, I would agree that it is impossible to fully prevent rogue keypairs from being made. Could you suggest a practical (not by hand) way of maintaining this list of 'allowed keypairs'? Does rpm signature checking have this facility? Regards. – OddSock Oct 31 '12 at 9:31
  • see the heading "Using Gpg to Sign Packages" in the rpm man page. %_gpg_path points to the directory with the "authorized" keyring. – Terrel Shumway Sep 4 '13 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.