2

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages?

I know that software downloaded with apt-get packages must be cryptographically verified because the repo's manifest files (synced with apt-get update) are cryptographically signed.

But what about yum?

Do Operating Systems with yum require valid signatures from a pinned set of keys on all packages by default?

Improve this question

1 Answer 1

Reset to default
1

Yes, CentOS & RHEL-based systems require valid gpg signatures on all packages in the default repositories, which provides cryptographic authentication and integrity for all packages.

This can be confirmed by checking for the line in the repo's cooresponding file in /etc/yum.repos.d/

gpgcheck=1

History

CentOS & RHEL use RPMs to distribute packages. The tools for managing RPMs have supported PGP signature functionality since at least v2.0.1, which was released sometime in or before 1996.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .