{"id":515,"date":"2021-07-23T12:31:53","date_gmt":"2021-07-23T12:31:53","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/how-to-set-up-a-third-party-rpm-repository-with-gpg-signatures\/"},"modified":"2021-07-23T12:31:53","modified_gmt":"2021-07-23T12:31:53","slug":"how-to-set-up-a-third-party-rpm-repository-with-gpg-signatures","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/how-to-set-up-a-third-party-rpm-repository-with-gpg-signatures\/","title":{"rendered":"How to Set Up a Third-Party RPM Repository with GPG Signatures"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n

In order for third-party customers to create their own RPM repositories, they must<\/strong> create digest files and GnuPG (GPG) signatures as well as the necessary RPM files.<\/p>\n

Most of cPanel\u2019s software dependencies ship as RPM archives. These RPMs download from the cPanel, L.L.C. RPM repository during installations and updates. The RPM repository is a collection of RPMs that exist on an accessible HTTP server. The url_templates<\/code> field in the rpm.versions<\/code> file determines the location of the RPMs on this server.<\/p>\n

Each RPM directory contains an rpm.md5<\/code> or rpm.sha512<\/code> digest file, which contains the appropriate digest values for each of the directory\u2019s RPMs. The cPanel, L.L.C. update system uses the digest file to ensure the integrity of downloaded files. In addition, a GPG signature, which the system creates with cPanel, L.L.C.\u2019s private keys, accompanies each of these digest files to ensure the legitimacy of the files and to prevent the compromise of download mirrors.<\/p>\n

Set up a third-party RPM repository with GPG signatures<\/h2>\n

Generate rpm sha512 digest files<\/h3>\n

In each directory in the repository that contains RPM files, you must<\/strong> create an rpm.sha512<\/code> digest file.<\/p>\n

For example, consider the following directory, which contains two RPM files:\n<\/p>\n

\n
\n\n\n
\n
1\n<\/span>2\n<\/span>3\n<\/span>4\n<\/span><\/code><\/pre>\n<\/td>\n
\n
root<\/span>@<\/span>httpupdate1<\/span>:\/<\/span>home<\/span>\/<\/span>www<\/span>\/<\/span>thirdparty_rpm<\/span>\/<\/span>11.92<\/span>\/<\/span>centos<\/span>\/<\/span>7<\/span>\/<\/span>x86_64<\/span>#<\/span> ls<\/span> -<\/span>l<\/span>\ntotal<\/span> 6876<\/span>\n-<\/span>rw<\/span>-<\/span>r<\/span>--<\/span>r<\/span>--<\/span> 1<\/span> tux<\/span> tux<\/span> 6191460<\/span> Aug<\/span> 12<\/span> 18<\/span>:57<\/span> cpanel<\/span>-<\/span>angularjs<\/span>-<\/span>1.4.3<\/span>-<\/span>1.<\/span>cp1154<\/span>.noarch<\/span>.rpm<\/span>\n-<\/span>rw<\/span>-<\/span>r<\/span>--<\/span>r<\/span>--<\/span> 1<\/span> tux<\/span> tux<\/span> 843872<\/span> Sep<\/span> 11<\/span> 17<\/span>:33<\/span> cpanel<\/span>-<\/span>angularjs<\/span>-<\/span>1.4.4<\/span>-<\/span>1.<\/span>cp1154<\/span>.noarch<\/span>.rpm<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
To create the digest file for this directory, run the following command: <\/p>\n
\n
\/home\/<\/span>www\/thirdparty_rpm\/<\/span>11.92<\/span>\/centos\/<\/span>7<\/span>\/<\/span>x86_64# sha512sum *.rpm > rpm.sha512<\/span><\/code><\/pre>\n<\/div>\n
This file will contain a list of the RPM file digests:<\/p>\n
\n
\n\n\n
\n
1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
\n
01<\/span>fe3fefade91693d2e03cd2f2a2cde7613e54586e994f3477658eefbe24c6ba0347129286789ad9fc8f1aa3f32859896aed16d39055031808eea057557691d2<\/span> cpanel<\/span>-<\/span>angularjs<\/span>-<\/span>1.4.3<\/span>-<\/span>1.<\/span>cp1154<\/span>.noarch<\/span>.rpm<\/span>\nf91a02c9fd3ef6551809ebb23e726cbe460fa8c334f592f53c773cbccc1b0cede9d139386b7e60b91bf25cd640ce9ecfd948c077bac12d2d8e069ca08a257da2<\/span> cpanel<\/span>-<\/span>angularjs<\/span>-<\/span>1.4.4<\/span>-<\/span>1.<\/span>cp1154<\/span>.noarch<\/span>.rpm<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
Generate a GPG key pair<\/h3>\n
After you create the digest file, create a GPG key pair in order to sign it. We recommend that you use the GPG command line utilities to generate the GPG key pair.<\/p>\n
    \n
  • \n
    We strongly<\/strong> recommend that you generate this key on a non-public system to protect the private key\u2019s security.<\/p>\n<\/li>\n
  • \n
    For more information, read the GnuPG documentation.<\/p>\n<\/li>\n<\/ul>\n
    For example, to create a GPG key pair, you might run the following commands:<\/p>\n
    \n
            Click to view…<\/p>\n
    \n
    \n
    \n
    \n\n\n
    \n
     1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span>19\n<\/span>20\n<\/span>21\n<\/span>22\n<\/span>23\n<\/span>24\n<\/span>25\n<\/span>26\n<\/span>27\n<\/span>28\n<\/span>29\n<\/span>30\n<\/span>31\n<\/span>32\n<\/span>33\n<\/span>34\n<\/span>35\n<\/span>36\n<\/span>37\n<\/span>38\n<\/span>39\n<\/span>40\n<\/span>41\n<\/span>42\n<\/span>43\n<\/span>44\n<\/span><\/code><\/pre>\n<\/td>\n
    		\n
    root<\/span>@<\/span>httpupdate1<\/span>:~#<\/span> gpg<\/span> --<\/span>gen<\/span>-<\/span>key<\/span>\ngpg<\/span> (GnuPG<\/span>) 1.4.12<\/span>; Copyright<\/span> (C<\/span>) 2012<\/span> Free<\/span> Software<\/span> Foundation<\/span>, Inc<\/span>.\nThis<\/span> is<\/span> free<\/span> software<\/span>: you<\/span> are<\/span> free<\/span> to<\/span> change<\/span> and<\/span> redistribute<\/span> it<\/span>.\nThere<\/span> is<\/span> NO<\/span> WARRANTY<\/span>, to<\/span> the<\/span> extent<\/span> permitted<\/span> by<\/span> law<\/span>.\nPlease<\/span> select<\/span> what<\/span> kind<\/span> of<\/span> key<\/span> you<\/span> want<\/span>:\n   (1<\/span>) RSA<\/span> and<\/span> RSA<\/span> (default<\/span>)\n   (2<\/span>) DSA<\/span> and<\/span> Elgamal<\/span>\n   (3<\/span>) DSA<\/span> (sign<\/span> only<\/span>)\n   (4<\/span>) RSA<\/span> (sign<\/span> only<\/span>)\nYour<\/span> selection<\/span>?<\/span> 4<\/span>\nRSA<\/span> keys<\/span> may<\/span> be<\/span> between<\/span> 1024<\/span> and<\/span> 4096<\/span> bits<\/span> long<\/span>.\nWhat<\/span> keysize<\/span> do<\/span> you<\/span> want<\/span>?<\/span> (2048<\/span>) 2048<\/span>\nRequested<\/span> keysize<\/span> is<\/span> 2048<\/span> bits<\/span>\nPlease<\/span> specify<\/span> how<\/span> long<\/span> the<\/span> key<\/span> should<\/span> be<\/span> valid<\/span>.\n         0<\/span> = key<\/span> does<\/span> not<\/span> expire<\/span>\n      <n<\/span>>  = key<\/span> expires<\/span> in<\/span> n<\/span> days<\/span>\n      <n<\/span>>w<\/span> = key<\/span> expires<\/span> in<\/span> n<\/span> weeks<\/span>\n      <n<\/span>>m<\/span> = key<\/span> expires<\/span> in<\/span> n<\/span> months<\/span>\n      <n<\/span>>y<\/span> = key<\/span> expires<\/span> in<\/span> n<\/span> years<\/span>\nKey<\/span> is<\/span> valid<\/span> for<\/span>?<\/span> (0<\/span>) 1<\/span>y<\/span>\nKey<\/span> expires<\/span> at<\/span> Fri<\/span> 11<\/span> Nov<\/span> 2016<\/span> 06<\/span>:59<\/span>:43<\/span> PM<\/span> UTC<\/span>\nIs<\/span> this<\/span> correct<\/span>?<\/span> (y<\/span>\/<\/span>N<\/span>) y<\/span>\nYou<\/span> need<\/span> a<\/span> user<\/span> ID<\/span> to<\/span> identify<\/span> your<\/span> key<\/span>; the<\/span> software<\/span> constructs<\/span> the<\/span> user<\/span> ID<\/span>\nfrom<\/span> the<\/span> Real<\/span> Name<\/span>, Comment<\/span> and<\/span> Email<\/span> Address<\/span> in<\/span> this<\/span> form<\/span>:\n    \"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>\"<\/span>\nReal<\/span> name<\/span>: Example<\/span> RPM<\/span> Repo<\/span>\nEmail<\/span> address<\/span>: example_rpm_repo<\/span>@<\/span>example<\/span>.net<\/span>\nComment<\/span>: This<\/span> is<\/span> demonstrating<\/span> the<\/span> creationg<\/span> of<\/span> a<\/span> third<\/span> party<\/span> cPanel<\/span> RPM<\/span> repository<\/span>.\nYou<\/span> selected<\/span> this<\/span> USER<\/span>-<\/span>ID<\/span>:\n    \"Example RPM Repo (This is demonstrating the creationg of a third party cPanel RPM repository.) <example_rpm_repo@example.net>\"<\/span>\nChange<\/span> (N<\/span>)ame<\/span>, (C<\/span>)omment<\/span>, (E<\/span>)mail<\/span> or<\/span> (O<\/span>)kay<\/span>\/<\/span>(Q<\/span>)uit<\/span>?<\/span> o<\/span>\nYou<\/span> need<\/span> a<\/span> Passphrase<\/span> to<\/span> protect<\/span> your<\/span> secret<\/span> key<\/span>.\n...<\/span>\ngpg<\/span>: key<\/span> 2<\/span>A8507D6<\/span> marked<\/span> as<\/span> ultimately<\/span> trusted<\/span>\npublic<\/span> and<\/span> secret<\/span> key<\/span> created<\/span> and<\/span> signed<\/span>.\ngpg<\/span>: checking<\/span> the<\/span> trustdb<\/span>\ngpg<\/span>: 3<\/span> marginal<\/span>(s<\/span>) needed<\/span>, 1<\/span> complete<\/span>(s<\/span>) needed<\/span>, PGP<\/span> trust<\/span> model<\/span>\ngpg<\/span>: depth<\/span>: 0<\/span>  valid<\/span>:   1<\/span>  signed<\/span>:   0<\/span>  trust<\/span>: 0<\/span>-<\/span>, 0<\/span>q<\/span>, 0<\/span>n<\/span>, 0<\/span>m<\/span>, 0<\/span>f<\/span>, 1<\/span>u<\/span>\ngpg<\/span>: next<\/span> trustdb<\/span> check<\/span> due<\/span> at<\/span> 2016<\/span>-<\/span>11<\/span>-<\/span>11<\/span>\npub<\/span>   2048<\/span>R<\/span>\/<\/span>2<\/span>A8507D6<\/span> 2015<\/span>-<\/span>11<\/span>-<\/span>12<\/span> [expires<\/span>: 2016<\/span>-<\/span>11<\/span>-<\/span>11<\/span>]\n      Key<\/span> fingerprint<\/span> = A554<\/span> 73<\/span>AE<\/span> 728<\/span>E<\/span> CBA9<\/span> 8283<\/span>  C6B3<\/span> 4<\/span>FE9<\/span> C226<\/span> 2<\/span>A85<\/span> 07<\/span>D6<\/span>\nuid<\/span>                  Example<\/span> RPM<\/span> Repo<\/span> (This<\/span> is<\/span> demonstrating<\/span> the<\/span> creationg<\/span> of<\/span> a<\/span> third<\/span> party<\/span> cPanel<\/span> RPM<\/span> repository<\/span>.) <example_rpm_repo<\/span>@<\/span>example<\/span>.net<\/span>>\nNote<\/span> that<\/span> this<\/span> key<\/span> cannot<\/span> be<\/span> used<\/span> for<\/span> encryption<\/span>.  You<\/span> may<\/span> want<\/span> to<\/span> use<\/span>\nthe<\/span> command<\/span> \"--edit-key\"<\/span> to<\/span> generate<\/span> a<\/span> subkey<\/span> for<\/span> this<\/span> purpose<\/span>.<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n
    Sign the rpm.sha512 digest files<\/h3>\n
    In order to prevent rollback, old version, or file-copy attacks, cPanel, L.L.C. uses a specific GPG signature notation that specifies the filename on the remote server.<\/p>\n
      \n
    • \n
      You must<\/strong> set this notation to use the public HTTP path for the file.<\/p>\n<\/li>\n
    • \n
      For example, for an rpm.sha512<\/code> file that exists at http:\/\/example.com\/rpm_repo\/11.92\/centos\/7\/x86_64\/rpm.sha512<\/code>, set the filename notation to \/rpm_repo\/11.92\/centos\/7\/x86_64\/rpm.sha512<\/code>.<\/p>\n<\/li>\n<\/ul>\n
      To sign the file in the previous examples, you would run the following command: <\/p>\n
      \n
      gpg --<\/span>output rpm.<\/span>sha512.<\/span>asc -<\/span>u \"example_rpm_repo@example.net\"<\/span> --<\/span>armor --<\/span>sig-<\/span>notation \"filename@gpg.notations.cpanel.net=\/thirdparty_rpm\/11.92\/centos\/7\/x86_64\/rpm.sha512\"<\/span> --<\/span>armor --<\/span>detach-<\/span>sign rpm.<\/span>sha512<\/code><\/pre>\n<\/div>\n
      Add your key to the vendor keystore<\/h3>\n
      In order to set up your cPanel & WHM servers to use the RPM repository, you must<\/strong> add a copy of the public key that signed the RPMs to each cPanel & WHM server. This allows each cPanel & WHM server to verify the signed RPM digests.<\/p>\n
      To export the public key, run the following command: <\/p>\n
      \n
      gpg --<\/span>output example_rpm_repo.<\/span>pub.<\/span>asc --<\/span>armor --<\/span>export<\/code><\/pre>\n<\/div>\n
      For the examples in this document, you could store this key as the https:\/\/example.com\/rpm_repo\/example_rpm_repo.pub.asc<\/code> file.<\/p>\n
      \n
      Note:<\/div>\n
      \n
        \n
      • You must<\/strong> store this key in a publicly web-accessible location.<\/li>\n
      • We strongly<\/strong> recommend that you store the key in a location that uses HTTPS\/SSL verification and encryption.<\/li>\n<\/ul><\/div>\n<\/div>\n
        To add this key to the local system, run the following command, where thirdparty<\/code> represents the vendor name and release<\/code> represents the category: <\/p>\n
        \n
        \/scripts\/<\/span>updatesigningkey --<\/span>vendor thirdparty --<\/span>category release --<\/span>url https:\/\/<\/span>example.<\/span>com\/rpm_repo\/<\/span>example_rpm_repo.<\/span>pub.<\/span>asc<\/code><\/pre>\n<\/div>\n
        Add the repository to the local versions file<\/h3>\n
        To configure the system to use the RPM repository\u2019s public key, update the \/var\/cpanel\/rpm.versions.d\/local.versions<\/code> file.<\/p>\n
          \n
        • \n
          For more information about this file, read our The rpm.versions<\/code> File documentation.<\/p>\n<\/li>\n
        • \n
          For more information about the \/scripts\/update_local_rpm_versions<\/code> script, which we strongly<\/strong> recommend for updates to the local.versions<\/code> file, read our The update_local_rpm_versions<\/code> Script documentation.<\/p>\n<\/li>\n<\/ul>\n
          Each RPM entry in the local.versions<\/code> file includes a corresponding rpm_location<\/code> entry. Each rpm_location<\/code> entry includes entries for url_templates<\/code> and location_keys<\/code> values.<\/p>\n
            \n
          • The url_templates<\/code> entry contains the location of each RPM, which includes the operating system version, architecture, package name, package version, and package revision.<\/li>\n
          • The location_keys<\/code> entry contains the vendor and category that you specified when you ran the \/scripts\/updatesigningkey<\/code> script.<\/li>\n<\/ul>\n
            For the examples in this document, the local.versions<\/code> file might appear similar to the following example:<\/p>\n
            \n
                    Click to view…<\/p>\n
            \n
            \n
            \n
            \n\n\n
            \n
             1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            ---<\/span>\nfile_format<\/span>:\n  version<\/span>: 2<\/span>\ninstall_targets<\/span>: {}\nlocation_keys<\/span>:\n  thirdparty_rpm<\/span>:\n    categories<\/span>:\n      -<\/span> release<\/span>\n    vendor<\/span>: thirdparty<\/span>\nrpm_groups<\/span>: {}\nrpm_locations<\/span>:\n  cpanel<\/span>-<\/span>angularjs<\/span>: thirdparty_rpm<\/span>\nsrpm_sub_packages<\/span>: {}\nsrpm_versions<\/span>:\n  cpanel<\/span>-<\/span>angularjs<\/span>: 1.4.4<\/span>-<\/span>1.<\/span>cp1154<\/span>\ntarget_settings<\/span>: {}\nurl_templates<\/span>:\n  thirdparty_rpm<\/span>: '<\/span>http<\/span>:\/\/<\/span>example<\/span>.com<\/span>\/<\/span>rpm_repo<\/span>\/<\/span>11.92<\/span>\/<\/span>centos<\/span>\/<\/span>[%<\/span> rpm_dist_ver<\/span> %<\/span>]\/<\/span>[%<\/span> rpm_arch<\/span> %<\/span>]\/<\/span>[%<\/span> package<\/span> %<\/span>]-<\/span>[%<\/span> package_version<\/span> %<\/span>]-<\/span>[%<\/span> package_revision<\/span> %<\/span>].noarch<\/span>.rpm<\/span>'<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n
            RPM repositories without GPG signatures<\/h3>\n
            \n
            Warning:<\/div>\n
            \n        We strongly<\/strong> discourage the creation of RPM repositories without GPG signatures. You cannot<\/strong> ensure the legitimacy of downloaded files without a signature.\n    <\/div>\n<\/div>\n
            If you do not<\/strong> need or want to verify the signature on your RPMs, you can disable signature verification. To do this, add a disabled<\/code> entry for the desired RPM to the location_keys<\/code> section, as in the following example:<\/p>\n
            \n
                    Click to view…<\/p>\n
            \n
            \n
            \n
            \n\n\n
            \n
             1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            ---<\/span>\nfile_format<\/span>:\n  version<\/span>: 2<\/span>\ninstall_targets<\/span>: {}\nlocation_keys<\/span>:\n  thirdparty_rpm<\/span>:\n    disabled<\/span>: 1<\/span>\nrpm_groups<\/span>: {}\nrpm_locations<\/span>:\n  cpanel<\/span>-<\/span>angularjs<\/span>: thirdparty_rpm<\/span>\nsrpm_sub_packages<\/span>: {}\nsrpm_versions<\/span>:\n  cpanel<\/span>-<\/span>angularjs<\/span>: 1.4.4<\/span>-<\/span>1.<\/span>cp1154<\/span>\ntarget_settings<\/span>: {}\nurl_templates<\/span>:\n  thirdparty_rpm<\/span>: '<\/span>http<\/span>:\/\/<\/span>example<\/span>.com<\/span>\/<\/span>rpm_repo<\/span>\/<\/span>11.92<\/span>\/<\/span>centos<\/span>\/<\/span>[%<\/span> rpm_dist_ver<\/span> %<\/span>]\/<\/span>[%<\/span> rpm_arch<\/span> %<\/span>]\/<\/span>[%<\/span> package<\/span> %<\/span>]-<\/span>[%<\/span> package_version<\/span> %<\/span>]-<\/span>[%<\/span> package_revision<\/span> %<\/span>].noarch<\/span>.rpm<\/span>'<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
            Overview In order for third-party customers to create their own RPM repositories, they must create digest files and GnuPG (GPG) signatures as well as the necessary RPM files. Most of cPanel\u2019s software dependencies ship as RPM archives. These RPMs download from the cPanel, L.L.C. RPM repository during installations and updates. The RPM repository is a …<\/p>\n","protected":false},"author":1,"featured_media":516,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/515"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=515"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/515\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/516"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}