Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-107489

RFE - To enable yumdb to verify checksum of installed packages

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • rhel-8.10
    • dnf
    • No
    • Impediment
    • Low
    • rhel-swm
    • None
    • Dev nak
    • True
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      The customer wants the yumdb or similar tool/utility in RHEL 8 and above. Currently this is available only in RHEL 7. For compliance and auditing they need to verify checksum values are same between Satellite and the RHEL server post installation. In RHEL 7 they are using "yumdb info" but no equivalent in RHEL 8. Example:
      ~~~
      [root@rhel7 ~]# yumdb info openssh-7.4p1-21.el7.x86_64
      Loaded plugins: langpacks, product-id, subscription-manager
      openssh-7.4p1-21.el7.x86_64
           checksum_data = 290ccc1f3e22a77ce692e451a70d7483a358b38358f908b622e85ce93b9d12db
           checksum_type = sha256
           from_repo = anaconda
           from_repo_revision = 1656415951
           from_repo_timestamp = 1656415983
           installed_by = 4294967295
           reason = dep
           releasever = 7.9
           var_uuid = 24c86fdf-7cbd-474e-9dd0-021dde050118
      ~~~

      The customer was educated that the packages/rpms are downloaded over an SSL connection from Satellite (via capsule). The RPMs are signed and the signature is checked when installing. Hence, we don't think you need to verify the rpms manually every time. You can execute the rpm -Va command from time to time to see if anything has changed since installation. The rpm -Va verifies all installed packages against the RPM database to detect if any installed files have been modified, deleted, or corrupted since installation.

      However, the customer informed that they need to to check the checksum manually of installed packages and for that they need the yumdb utility.  
           
      They need yumdb to verify checksum of installed packages for security and compliance requirement for auditing. The Auditor will verify whether the installed package is right one from satellite and matching the checksum, which is missing.

              packaging-team-maint packaging-team-maint
              rhn-support-abjoshi Abhijeet Joshi
              packaging-team-maint packaging-team-maint
              Software Management QE Software Management QE
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: