PowerProtect Data Manager 19.10 Security Configuration Guide

Verify GPG signatures for Linux (RPM-based) packages

Use these steps to confirm that a Linux RPM package file was signed by Dell and has not changed since the signing.

1. Open a terminal window or shell session.
2. Change directory to the location of the package file.
3. Verify that the package file has a signature:

   rpm --checksig -v package

   where package is the package filename.

   If the package file has a signature, output similar to the following appears:

   package:
   Header V3 RSA/SHA1 Signature, key ID c5dfe03d: NOKEY
   Header SHA1 digest: OK 81e359380a5e229d96c79135aea58d935369c827)
   V3 RSA/SHA1 Signature, key ID c5dfe03d: NOKEY
   MD5 digest: OK (cc2ac691f115f7671900c8896722159c)
   

   The NOKEY messages indicate that the Linux system does not recognize the signing key.

4. Locate the applicable Dell public key in the KB article.
   Copy the public key to a new text file on the Linux system and save the file.
5. Import the Dell public key to the local trust store:

   rpm --import keyfile

   where keyfile is the text file that you created in a previous step.

6. With the Dell public key imported, reverify that the package file has a valid signature:

   rpm --checksig -v package

   where package is the package filename.

   If the package file has a valid signature, output similar to the following appears:

   package:
   Header V3 RSA/SHA1 Signature, key ID c5dfe03d: OK
   Header SHA1 digest: OK (81e359380a5e229d96c79135aea58d935369c827)
   V3 RSA/SHA1 Signature, key ID c5dfe03d: OK
   MD5 digest: OK (cc2ac691f115f7671900c8896722159c)
   

   The OK messages indicate that the Linux system recognizes that the package was signed by a trusted key.