updateose.blogg.se

The RPM format has an area specifically reserved to hold a signature of the header and payload. While GPG can sign any file, manually checking package signatures is not scalable for system administrators.

To detect and avoid malicious replacement packages, package owners can sign the package files, and consumers can verify those signatures. For many open-source projects, that includes hosting by volunteers. The projects and companies providing the packages utilize content distribution networks (CDNs) and mirror sites to make their packages available to consumers. Large and popular RPM repositories are typically replicated around the world.