How to do RPM package signature verification in Windows?

Question

I’m trying to do GPG signature validation to Centos 7 RPM files that I have downloaded. They are validated during the first download, but I am trying to another validation after they have been transferred to a Windows computer.

I have downloaded the Gpg4win/gnuPG. Then saved the CentOS 7 Signing Key (to .sig. and .asc). I have even imported it to Kleopatra (just to be sure).

I can verify .exe file but RPM are not working. Is the gpg.exe the right tool for doing RPM package signature verification in Windows??

Commands that are not working: Im trying to execute command/exe (C:\Program Files (x86)\GnuPG\bin\gpg.exe)

gpg.exe --verify RPM_File.rpm
gpg.exe --verify sig_file.sig RPM_File.rpm

The end goal is to do PowerShell script that verifies all the files.

---

Edit:

So it seems that there is no Windows software to solve this issue, at least i can not find it. I started to entertain the idea of installing Windows Subsystem for Linux to the Windows host to gain access to bash and rpm. I don't know what kind usability it will be to call (even from PowerShell) rpm to do the signature validation.

Answer 1

Actually, you can. I just found out about this myself. The Cygwin software includes modules for both gpg and rpm, that you can use to validate RPM files on Windows.

1. Download setup*.exe (as appropriate for your hardware/os) from Cygwin's website, https://cygwin.com/install.html
2. Run that file to do the basic install of Cygwin.
3. Select Install from Internet, and accept all defaults by selecting next.
4. Select the following packages when prompted for "Select Packages"
   • gnupg2
   • rpm
5. Select next to complete the install.

From that point, you use:

• the rpm --import command to import the public keys that signed the RPM files; and,
• the rpm -K command to verify the RPM signatures, which includes validation of integrity.