rpmskäivor

rpmskäivor is an open‑source utility designed to analyze and verify RPM (Red Hat Package Manager) package archives. The tool examines package metadata, checks dependencies, validates GPG signatures, and reports potential conflicts or unmet requirements before installation. It is intended for use by system administrators, distro maintainers, and developers who need a quick way to audit RPM files for correctness and security.

The project began in 2016 as a side effort by a small group of developers at the University of Oslo’s Software Engineering laboratory. The original implementation was written in Python and bundled with several small helper scripts. It quickly gained attention in the packaging community because it filled a gap left by other tools that either focused on installing packages or on generating repository metadata. rpmskäivor’s first stable release (v1.0) appeared on GitHub on 2017‑03‑12 and was subsequently included in the Fedora Extra Packages for Enterprise Linux (EPEL) repository.

rpmskäivor relies on the libsolv library for dependency resolution and on a local SQLite database to cache metadata between runs. The command‑line interface accepts either a single .rpm file or a directory of packages and outputs a structured report in JSON or plain text. An optional “--strict” mode forces the tool to treat missing signatures as errors, making it useful for high‑security build environments.

The most recent major release, 2.3, added support for RPM version 4.18, introduced parallel processing of package lists, and improved error reporting for broken dependencies. rpmskäivor is actively maintained, receives contributions from developers worldwide, and is integrated into several continuous‑integration pipelines for major Linux distributions. It complements related tools such as rpm, rpmdevtools, and rpmauth.