Questão de Linux Administration #019e3987

The rpm --verify command checks the integrity of installed RPM packages by comparing current file attributes against the metadata stored in the RPM database. The verification process examines several attributes, including timestamps, MD5 checksums, and file sizes. Timestamps are compared to detect modifications; MD5 checksums ensure file content has not changed; file sizes verify the file length matches the original. Inodes are not verified because they are filesystem-specific and can change without affecting file integrity. GnuPG signatures are used during package installation to authenticate the package source, but they are not part of the verification of installed files.

How it Works

When rpm --verify runs, it reads the RPM database and compares each file's current attributes (e.g., modification time, size, MD5 digest) against the stored values. Any mismatch is reported. This helps detect accidental or malicious alterations.

Why the Correct Values Are Right

• Timestamps: The modification time (mtime) is stored and compared. A change indicates the file was touched or modified.
• MD5 checksums: A cryptographic hash of the file content is stored. Any change in content alters the hash, making this a reliable integrity check.
• File sizes: The original file size is recorded. A different size suggests content modification or corruption.

Why the Incorrect Values Are Wrong

• Inodes: Inode numbers are filesystem metadata that can change when files are moved or copied. They are not stored in the RPM database and are not verified.
• GnuPG signatures: These are used to verify the authenticity of the RPM package itself before installation. Once installed, the signature is not part of the file attributes checked by --verify.