rpm --import /mnt/cdrom/RPM-GPG-KEY



rpm -qa gpg-pubkey*



gpg-pubkey-db42a60e-37ea5438



rpm -qi gpg-pubkey-db42a60e-37ea5438



rpm -K /tmp/updates/*.rpm







All Fedora packages are signed with the Fedora GPG key. GPG stands for GNU Privacy Guard, or GnuPG, a free software package used for ensuring the authenticity of distributed files. For example, a private key () locks the package while the public key unlocks and verifies the package. If the public key distributed by Fedora does not match the private key during RPM verification, the package may have been altered and therefore cannot be trusted.The RPM utility within Fedora automatically tries to verify the GPG signature of an RPM package before installing it. If the Fedora GPG key is not installed, install it from a secure, static location, such as an Fedora installation CD-ROM or DVD.Assuming the fedora installation disc is mounted in, use the following command to import it into the keyring ():To display a list of all keys installed for RPM verification, execute the following command:The output will look similar to the following:To display details about a specific key, use thecommand followed by the output from the previous command, as in this example:It is extremely important to verify the signature of the RPM files before installing them to ensure that they have not been altered from the original source of the packages. To verify all the downloaded packages at once, issue the following command:For each package, if the GPG key verifies successfully, the command returns gpg. If it doesn't, make sure you are using the correct Fedora public key, as well as verifying the source of the content. Packages that do not pass GPG verifications should not be installed, as they may have been altered by a third party.After verifying the GPG key and downloading all the packages associated with the errata report, install the packages as root at a shell prompt.