rpmsign

rpmsign is a command-line utility used on RPM-based Linux systems to apply cryptographic signatures to RPM packages and source RPMs using a GNU Privacy Guard (GPG) key. Signing packages provides a way to verify authenticity and integrity during distribution and installation, helping to establish provenance for both binaries and source packages.

The tool relies on a properly configured GPG keyring and the RPM signing configuration on the host. A private GPG key must be available to sign, and users typically configure signing preferences through GPG and RPM macro settings. rpmsign operates within the existing RPM and GPG ecosystems, producing signatures that can be embedded in the RPM file or created as detached signatures, depending on the workflow and distribution requirements.

A common workflow involves generating or importing a suitable GPG key, configuring the signing key in the local environment or build system, and then invoking rpmsign to attach signatures to built RPMs or SRPMs. After signing, the RPMs can be verified by end users or automated systems using rpm --checksig or rpm --verify to confirm that the signature matches the package and that the package has not been tampered with since signing. Signing is often performed in build pipelines, release processes, or by maintainers distributing third-party repositories, to provide assurance of package integrity and origin.

Notes and considerations include the need to protect private signing keys, the possibility of using detached signatures for separate distribution, and the fact that some distributions provide the signing tool as part of a dedicated package (often named rpm-sign or rpmsign). rpmsign is a specialized utility within the broader RPM tooling ecosystem and does not replace package signing policies or repository-wide verification practices.