Verifying signature of IBM Storage Scale packages

All IBM Storage Scale packages for Red Hat® Enterprise Linux® and SLES operating systems on all supported architectures are signed with a GPG (GNU Privacy Guard) key by IBM®. The repository metadata is also signed by IBM. You can verify that an IBM Storage Scale package and repository metadata are signed by IBM as follows.
The public key is located in a file that is called SpectrumScale_public_key.pgp and this file is present in the IBM Storage Scale installation images that can be downloaded from IBM Fix Central. For the latest version of the public key, see IBM Storage Scale FAQ in IBM Documentation.
Important: If you are using the installation toolkit, no additional steps are required. The installation toolkit checks, the signature of each package, and the repository metadata automatically before installation or upgrade.

For manual installation or upgrade, if you do not want to verify that the packages are signed, no additional steps are required. The signed packages functions the same as the unsigned packages. If you want to manually verify that the packages are signed by IBM, perform the following steps:

  1. Import the public key into the RPM database. 
    rpm --import SpectrumScale_public_key.pgp
    Note: Some Red Hat packages are required for object installation. These packages are signed by Red Hat with a GPG key. This key is called RPM-GPG-KEY-redhat-release and it is located in the /usr/lpp/mmfs/<release>/Public_Keys/ directory. If you want to manually install object, along with importing the IBM public key, you can import the Red Hat key as follows:
    rpm --import /usr/lpp/mmfs/<release>/Public_Keys/RPM-GPG-KEY-redhat-release
  2. Confirm that the public key is imported into the RPM database. 
    rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE} \ n%{INSTALLTIME:date} \ n%{SUMMARY}\n\n'  | grep SpectrumScale
  3. Check the package's signature. 
    rpm -K PackageName

    You can check the signature of more than one package by using wildcard characters. For example:

    rpm -K *.rpm.