3 ms·
Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?
by GordonS 5y ago
Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?
- dfghdfgj 5y agoThis applies to almost all modern linux package managers. PGP is typically used to sign a collection of hashes (and other metadata). PGP is generally only used at package install/build time, and the subsequently installed/generated manifest is used when you ask the package manager to verify the package.
- marbu 5y agoIt just compares expected checksum from rpm database with actual state in the system. That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.