CAS-002 · Question #248
An administrator attempts to install the package "named.9.3.6-12-x86_64.rpm" on a server. Even though the package was downloaded from the official repository, the server states the package cannot be…
The correct answer is C. Import the repository's public key. RPM package managers verify package authenticity using GPG signatures. Without the repository's public key imported, the system cannot validate the package signature and will refuse installation.
Question
An administrator attempts to install the package "named.9.3.6-12-x86_64.rpm" on a server. Even though the package was downloaded from the official repository, the server states the package cannot be installed because no GPG key is found. Which of the following should the administrator perform to allow the program to be installed?
Options
- ADownload the file from the program publisher's website.
- BGenerate RSA and DSA keys using GPG.
- CImport the repository's public key.
- DRun sha1sum and verify the hash.
How the community answered
(54 responses)- A7% (4)
- B2% (1)
- C87% (47)
- D4% (2)
Why each option
RPM package managers verify package authenticity using GPG signatures. Without the repository's public key imported, the system cannot validate the package signature and will refuse installation.
Downloading from the publisher's website does not resolve the GPG key trust issue - the package still requires the repository's public key to be present in the local keyring for signature verification.
Generating new RSA/DSA keys creates a new keypair for the local user and has no effect on verifying the repository's existing package signatures.
RPM-based systems use GPG signatures to verify package authenticity. When a package is signed by a repository, the corresponding public key must be imported into the system's RPM keyring using 'rpm --import' or via the repo's GPG key file. Without this trusted public key, the signature cannot be verified and installation is blocked regardless of the package's source.
Running sha1sum verifies file download integrity against a known hash but does not address GPG signature verification, which is a separate cryptographic trust mechanism.
Concept tested: RPM package GPG signature verification and key import
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_software_with_the_dnf_tool/assembly_signing-packages_managing-software-with-the-dnf-tool
Topics
Community Discussion
No community discussion yet for this question.