RPM

RPM (Red Hat Package Manager) is a powerful package management system used primarily on Linux distributions such as Red Hat Enterprise Linux, Fedora, CentOS, and others. It provides a standardized method for installing, updating, querying, verifying, and removing software packages. Each RPM package contains compiled software programs, configuration files, and metadata, allowing efficient software deployment and management.

RPM Package Structure

Package Contents

An RPM package is essentially an archive that contains the following:

• Payload: The actual files to be installed, such as binaries, libraries, documentation, and configuration files.
• Metadata: Information describing the package, including its name, version, release, architecture, summary, description, license, vendor, and group.
• Scripts: Optional shell scriptlets (pre-install, post-install, pre-uninstall, post-uninstall) executed at various stages during installation or removal to handle setup or cleanup tasks.
• Dependencies: Requirements specifying which other packages or capabilities must be present for this package to install or function correctly.
• File Attributes: Permissions, ownership, and file types for each file in the package.
• Signature: Cryptographic signature used to verify the package’s integrity and authenticity.

Package Naming Convention

An RPM package filename typically follows the format:

name-version-release.architecture.rpm

• name: The software package name.
• version: The upstream software version.
• release: The packaging release number.
• architecture: The target hardware platform (e.g., x86_64, noarch).

RPM Database

RPM maintains a local database on the system, which tracks all installed packages and their associated files. This database enables RPM to:

• Identify installed packages.
• Verify file integrity.
• Track file ownership.
• Manage package upgrades and removals.

The database is stored in a binary format, usually located in /var/lib/rpm/.

RPM Database Operations

RPM commands interact with this database to:

• Query what packages are installed.
• Check which files belong to which packages.
• Verify package contents for corruption or file modifications.
• Manage package dependencies.

RPM Package Operations

RPM supports multiple operations to manage software packages:

Installation

rpm -i package.rpm

Installs a new package. Fails if dependencies are missing or if the package is already installed.

Upgrade

rpm -U package.rpm

Installs a package or upgrades an existing one to a newer version, replacing older files.

Reinstall

rpm -i --replacepkgs package.rpm

Reinstalls a package, overwriting existing files without removing the package first.

Removal

rpm -e package_name

Removes an installed package and all its tracked files.

RPM Queries and Verification

RPM provides extensive querying capabilities to inspect installed packages or RPM files:

Querying Packages

• List installed packages:

rpm -qa

• Show detailed information about a package:

rpm -qi package_name

• List files installed by a package:

rpm -ql package_name

• Find which package owns a file:

rpm -qf /path/to/file

Verification

RPM can verify installed packages to detect changes or corruption in files:

rpm -V package_name

The verification checks for differences in file size, MD5 checksum, permissions, owner, group, and modification time.

RPM Scriptlets and Triggers

Scriptlets

RPM packages can define scripts executed automatically during package lifecycle events:

• %pre: Runs before package installation.
• %post: Runs after package installation.
• %preun: Runs before package removal.
• %postun: Runs after package removal.

These scripts can perform setup tasks such as creating users, updating configuration files, or restarting services.

Triggers

Triggers allow packages to react to changes in other packages. For example, a package can define a trigger to update caches or restart services if another package is installed, upgraded, or removed.

RPM Keyring and Signature Verification

RPM supports package signing and signature verification to ensure package authenticity and integrity.

• RPM Keys: Public keys are imported into the RPM keyring to verify package signatures.
• Signing Packages: A package maintainer signs an RPM using a private key.
• Verification: Before installation, RPM checks the package signature against imported keys to confirm the package has not been tampered with.

Commands to manage keys:

rpm --import public_key_file

To verify signatures during installation:

rpm -K package.rpm

RPM is a comprehensive system that facilitates consistent and secure software management on RPM-based Linux distributions, enabling administrators to handle software lifecycle efficiently while maintaining system integrity and dependency consistency.