{"id":146238,"date":"2025-10-24T11:12:33","date_gmt":"2025-10-24T09:12:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-fedora-44-v-rpm-namereny-aktivirovat-proverku-paketov-po-czifrovoj-podpisi"},"modified":"2025-10-24T11:12:33","modified_gmt":"2025-10-24T09:12:33","slug":"v-fedora-44-v-rpm-namereny-aktivirovat-proverku-paketov-po-czifrovoj-podpisi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-fedora-44-v-rpm-namereny-aktivirovat-proverku-paketov-po-czifrovoj-podpisi","title":{"rendered":"In Fedora 44, there are plans to enable digital signature package verification in RPM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the upcoming Fedora Linux 44, scheduled for release in spring 2026, the default implementation will include package verification through digital signatures in RPM. If the plan is approved by the FESCo (Fedora Engineering Steering Committee), which oversees the technical aspects of Fedora Linux development, only packages with a valid digital signature will be installable by default. If necessary, there will be an option to bypass this verification by explicitly running RPM with the flag \u2018--nosignature\u2019 or disabling verification through the corresponding API. <\/p>\n
The functionality for verifying packages by digital signature was implemented in the RPM package manager 6.0, but in Fedora 43, despite transitioning to RPM 6, only hash integrity checks are used at the RPM level, while the authenticity of packages from repositories is verified at the high-level package managers YUM and DNF, where the ability to verify by digital signatures was originally implemented and enabled by default. Now similar verification is intended to be employed at the RPM level. If the change is approved in Fedora 44, both integrity checking via hash and authenticity checking via a digital signature signed by the package builder's key will be performed when installing packages via RPM. <\/p>\n
When attempting to install packages without a signature or with an incorrect signature, an error will be displayed by default unless the user explicitly runs rpm with the flag \u2018--nosignature\u2019. For working with external repositories that do not provide digital signatures, the DNF package manager version 5.2.14.0 includes the ability to selectively disable RPM verification tied to individual packages. This feature is utilized in the Mock (mock-core-configs) tool for working with new package builds. Additionally, Mock has added a plugin for generating signatures for locally built packages, and the Copr (Community projects) service has implemented the capability for automatic signature generation. <\/p>\n