Difference between revisions of "Package signatures"
(Started) |
(Filled in →Checking RPM packages) |
||
| Line 9: | Line 9: | ||
== Checking RPM packages == | == Checking RPM packages == | ||
| + | In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following: | ||
| + | <pre> | ||
| + | # rpm --import RPM-GPG-Key-OpenVZ | ||
| + | </pre> | ||
| + | Then, to check the packages, use this command: | ||
| + | <pre> | ||
| + | $ rpm -K *.rpm | ||
| + | </pre> | ||
| + | Here <tt>*.rpm</tt> are some RPM packages. | ||
== Checking files == | == Checking files == | ||
Revision as of 10:02, 13 June 2006
All the packages that are released by OpenVZ project are digitally signed by OpenVZ GPG key. Thus, you can check that those packages are indeed came from OpenVZ.
Public and private keys
There is a pair of keys generated for the purpose of signing and verifying the signature.
Private key is the key that is available to OpenVZ stuff only and is protected by the passphrase. This key is used for signing the packages, so nobody else but OpenVZ stuff can sign them using this key.
Public key is the key that is available to everyone and can be obtained from a number of places (e.g. MIT keyserver — search for OpenVZ). Public key is used to verify the signature.
Checking RPM packages
In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following:
# rpm --import RPM-GPG-Key-OpenVZ
Then, to check the packages, use this command:
$ rpm -K *.rpm
Here *.rpm are some RPM packages.
