RPM cannot be signed with V4 signature only in Red Hat Enterprise Linux 8
Issue
- We signed our custom
RPM
package withRPM V4 signature
by following this article: https://access.redhat.com/articles/3359321 - I removed
--force-v3-sigs
option from gpg command options to sign it withRPM V4 signature
. - Our expectation was that the signed
RPM
package has theRPM V4 signature
only after reading this blog article:
https://www.redhat.com/en/blog/securing-rpm-signing-keys - But the result was that it had the two signatures.
# rpm -Kv /root/rpmbuild/RPMS/x86_64/custom-1.0-1.el8.x86_64.rpm
/root/rpmbuild/RPMS/x86_64/custom-1.0-1.el8.x86_64.rpm:
Header V4 RSA/SHA256 Signature, key ID 47fca7e4: OK <<=== for Header
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
V4 RSA/SHA256 Signature, key ID 47fca7e4: OK <<=== for Header + Payload
MD5 digest: OK
- How can we make a V4 signature only in our RPM package?
Environment
Red Hat Enterprise Linux 8
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.