Sign with RPM Signatures | Keyfactor Docs

Enterprise

Instead of a dedicated RPM package Signer, SignServer leverages OpenPGP Signer or OpenPGP Plain Signer to generate signatures and SignWrapper-GPG to integrate those signatures into the RPM signing workflow.

The SignWrapper-GPG is a script that wraps SignClient and behaves like a gpg (GnuPG) command, allowing the standard rpm-sign tool to use signwrapper-gpg instead of gpg. Because RPM embeds signatures directly inside the package file, this scheme requires some logic on the client side: preparing the file, hashing it, and inserting the resulting signature into the RPM data structure.

Both Signers use OpenPGP public keys instead of X.509 certificates. The public key can instead be obtained from the Worker's status output. Additionally, the Generate CSR functionality lets you associate a User ID with the key and store it in the PGPPUBLICKEY property. When using RSA keys for RPM signing, this step is required to produce the correct key type.

For more information on signing RPM packages with GPG, refer to the Red Hat Documentation.

Prerequisite: OpenPGP Signer Configured

In the Set up OpenPGP Signer, follow the steps to configure a OpenPGP Signer or OpenPGP Plain Signer, add User ID and certification, and generate a revocation certificate.

Use the OpenPGP Plain Signer if you want client-side hashing. For details on required parameters, see OpenPGP Plain Signer and the Signing RPM Packages section of the client-side hashing page.

Set up RPM for Signing using SignWrapper-GPG

The SignServer SignWrapper-GPG replaces the gpg (GnuPG) command in the RPM signing workflow by routing requests through SignClient. Three components need to be configured: the RPM tool, SignWrapper-GPG itself, and SignClient.

Configure RPM Tool

For the user that will run the rpm command, create or update .rpmmacros in the user home directory:

%_signature gpg
%_gpg_name <Signer name>
%__gpg /opt/signserver/bin/signwrapper-gpg

The %_gpg_name should have the name of the configured OpenPGP Signer or OpenPGP Plain Signer.

The %__gpg should contain the path to the signwrapper-gpg.

Configure SignWrapper-GPG

SignWrapper-GPG needs to know where SignClient is located. If signwrapper-gpg is not kept in the SignClient folder, set one of the following environment variables:

SIGNCLIENT_CMD: Set to the full path of the bin/signserver script, or
SIGNCLIENT_HOME or SIGNSERVER_HOME: Set to the root folder of the SignClient distribution.

Configure SignClient

Set the following environment variables so SignWrapper-GPG can connect to your SignServer instance:

Variable	Description
`SIGNCLIENT_HOSTS`	Value for the `-hosts HOSTS` SignClient parameter is the hostname or IP-address of the SignServer host or a comma separated list of hosts. Example: `signserver1.example.com`
`SIGNCLIENT_PORT`	Value for the `-port PORT` SignClient parameter is the TCP port on the SignServer host to use. Example: `8080`
`SIGNCLIENT_PARAMS`	(Optional) Value for any extra parameters to put on the SignClient command line. Example: `-truststore TRUSTSTORE -truststorepwd PWD`

Variable

Description

SIGNCLIENT_HOSTS

Value for the -hosts HOSTS SignClient parameter is the hostname or IP-address of the SignServer host or a comma separated list of hosts.

Example: signserver1.example.com

SIGNCLIENT_PORT

Value for the -port PORT SignClient parameter is the TCP port on the SignServer host to use.

Example: 8080

SIGNCLIENT_PARAMS

(Optional) Value for any extra parameters to put on the SignClient command line.

Example: -truststore TRUSTSTORE -truststorepwd PWD

If using the OpenPGP Plain Signer with client-side hashing, the SIGNCLIENT_PARAMS variable is required.
Example of SIGNCLIENT_PARAMS usage for client-side hashing:

export SIGNCLIENT_PARAMS="-clientside -digestalgorithm SHA-256 -extraoption KEY_ID=<Key ID> -extraoption KEY_ALGORITHM=1 -extraoption RESPONSE_FORMAT=BINARY -extraoption DETACHED_SIGNATURE=true -filetype PGP"

For more details on the command, see SignWrapper-GPG.

Sign an RPM Package

The standard RPM tool is used to request signing by using the SignWrapper-GPG and SignClient.

With the RPM tool configured to use SignWrapper-GPG, sign a package using the standard rpm command:

rpm --addsign release.rpm

When the command completes, the release.rpm contains the embedded signature.

Verify the Signature

Use the RPM tool to verify the signature.

If the Signer's public key is not yet imported into RPM, import it first:

Save the public key (from PGPPUBLICKEY property) as signer001-pub.asc.
Import the key to RPM:
```
$ rpm --import signer001-pub.asc
```

Verify the signature:

$ rpm --checksig release.rpm

To retrieve more details about the signature, including the algorithm and key ID:

rpm -qp --qf '%|DSAHEADER?{%{DSAHEADER:pgpsig}}:{%|RSAHEADER?{%{RSAHEADER:pgpsig}}:{(none)}|}|\n' release.rpm

(Optional) Distribute the Public Key

The OpenPGP public key can be published to online key servers or distributed to clients by other means.