I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer.

How can I sign my rpm using these extra signature and certification file without GPG?

  • That depends entirely on what the smart card is. – user49075 Jun 10 '15 at 4:17
  • It is a normal hardware certification for signing, encryption, and decryption. Use PKCS#11 standard and RSA algorithm. Th .cer file could be converted to .pem file by OpenSSL. I could verify signature by OpenSSL. But I don't know how to use it while signing and verifying RPM installation. – cchuang0425 Jun 10 '15 at 6:22

Per https://stackoverflow.com/questions/50622163/rpm-signing-using-x-509-certificatesenter link description here there is no way to sign RPMs with x509 style signatures that will be checked by the standard tools for installing RPMS. If signing x509 style is the important part then your best bet is to distribute the two files alongside the rpm along with instructions to those who care on how to use them to verify the origin of the rpm.

If on the other hand your primary goal is to use the keys on your smartcard rather than avoiding gnupg then you should be able to use gnupg-pkcs11 to enable gnupg to talk to your PKCS#11 token (assuming that is what you smart card is) and add a PGP signature which can be automatically checked by the standard tools for managing rpms.

Going the other way (using a PGPcard as a PKCS#11 token) is supported by Scute

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.