3.2. Digital Signatures for RHN Packages
All packages distributed through RHN should have a digital signature. A digital signature is created with a unique private key and can be verified with the corresponding public key. After creating a package, the SRPM (Source RPM) and the RPM can be digitally signed with a GnuPG key. Before the package is installed, the public key is used to verify the package was signed by a trusted party and the package has not changed since it was signed.
3.2.1. Generating a GnuPG Keypair
A GnuPG keypair consists of the private and public keys. To generate a keypair type the following command as the root user on the shell prompt:
gpg --gen-key |
If you execute this command as a non-root user, you see the following message:
gpg: Warning: using insecure memory! |
This message appears because non-root users cannot lock memory pages. Since you do not want anyone else to have your private GnuPG key or your passphrase, you want to generate the keypair as root. The root user can lock memory pages, which means the information is never written to disk.
After executing the command to generate a keypair, you see an introductory screen containing key options similar to the following:
gpg (GnuPG) 1.2.6; Copyright (C) 2004 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. Please select what kind of key you want: (1) DSA and ElGamal (default) (2) DSA (sign only) (4) RSA (sign only) Your selection? |
Accept the default option: (1) DSA and
ElGamal. This option allows you to create a digital
signature and encrypt/decrypt with two types of technologies. Type
1 and then press
Next, choose the key size, which is how long the key should be. The longer the key, the more resistant against attacks your messages are. Creating a key of at least 1024 bits in size is recommended.
The next option asks you to specify how long you want your key to be valid. If you do choose an expiration date, remember that anyone who is using your public key must also be informed of its expiration and supplied with a new public key. It is recommended that you select no expiration date. If you do not choose an expiration date, you are asked to confirm your decision:
Key does not expire at all Is this correct (y/n)? |
Press
Your next task is to provide a User-ID containing your name, your email address, and an optional comment. Each is requested individually. When you are finished, you are presented with a summary of the information you entered.
Once you accept your choices, you enter a passphrase.
 | Tip |
|---|---|
Like your account passwords, a good passphrase is essential for optimal security in GnuPG. Mix your passphrase with uppercase and lowercase letters, use numbers, and/or include punctuation marks. |
Once you enter and verify your passphrase, your keys are generated. A message similar to the following appears:
We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. +++++.+++++.++++++++....++++++++++..+++++.+++++.+++++++.+++++++ +++.++++++++++++++++++++++++++++++++++++++..........................++++ |
When the activity on the screen ceases, your new keys are placed in the directory .gnupg in root's home directory. This location is because you are ran the command as root. To list your root keys, use the command:
gpg --list-keys |
The output is similar to the following:
/root/.gnupg/pubring.gpg ----------------------------------------- pub 1024D/B7085C8A 2002-02-18 Your Name <[email protected]> sub 1024g/E12AF9C4 2002-02-18 |
To retrieve your public key, use the following command:
gpg --export -a 'Your Name' > public_key.txt |
Your public key is written to the file public_key.txt.
This public key is quite important. It's the key that must be deployed to all client systems that receive custom software through up2date. Techniques for deploying this key across an organization are covered in the Red Hat Network Client Configuration Guide.
3.2.2. Signing packages
Before you can sign packages, you need to configure your ~/.rpmmacros file to include the following:
%_signature gpg %_gpg_name B7085C8A |
Replace the _gpg_name key ID value of B7085C8A with the key ID from your GPG keyring that you use to sign packages. This value tells RPM which signature to use.
To sign the package package-name-1.0-1.noarch.rpm, use the following command:
rpm --resign package-name-1.0-1.noarch.rpm |
Enter your passphrase. To make sure the package is signed, use the following command:
rpm --checksig -v package-name-1.0-1.noarch.rpm |
You should see the phrase Good signature from "Your Name" in the output, with Your Name replaced with the name associated with the signing key.