4.3 RPM Package Management with rpm (102.5)

4.3 RPM Package Management with rpm (102.5)

Quick Summary: The RPM Package Manager (rpm) is the foundational low-level package management tool utilized across Red Hat Enterprise Linux (RHEL), CentOS, Fedora, Rocky Linux, AlmaLinux, and openSUSE. Similar to Debian's dpkg, the rpm utility works directly with local .rpm archive files and queries the local RPM database located in /var/lib/rpm/. It handles installation, querying, verification, and uninstallation, but does not automatically download packages over a network or resolve missing multi-package dependencies.

---

1. RPM Package Architecture & Naming Conventions

Every RPM binary package filename adheres to a strict five-element naming structure. Candidates on the LPIC-1 exam must be able to decompose an RPM filename into its constituent parts.

   httpd   -   2.4.51   -     1.el9     .   x86_64   .rpm
  └──┬──┘     └───┬───┘     └───┬───┘      └───┬──┘
   Name        Version       Release      Architecture

RPM Naming Components

1. Package Name (name): The base identifier of the software application (e.g., httpd, bash, kernel, bind).
2. Version (version): The upstream software developer's release version (e.g., 2.4.51, 5.2.15).
3. Release (release): The distribution maintainer's build and revision count, often containing OS release tags (e.g., 1.el9 indicates build 1 for Enterprise Linux 9; 3.fc38 indicates build 3 for Fedora 38).
4. Architecture (architecture): The target hardware instruction set architecture:
   • x86_64: 64-bit AMD/Intel x86 processors
   • aarch64: 64-bit ARM processors
   • i686 / i386: 32-bit x86 legacy systems
   • noarch: Architecture-independent packages containing documentation, Python/Perl scripts, or assets.
5. Extension (.rpm): Standard file extension for RPM package archives.

⚠️ LPIC-1 Trap: When installing or upgrading software using rpm -i or rpm -U, you must provide the full path or filename of the .rpm file (e.g., httpd-2.4.51-1.el9.x86_64.rpm). When querying or erasing an installed package with rpm -q or rpm -e, you specify only the package name (e.g., httpd).

---

2. Package Lifecycle Modes: Install, Upgrade, Freshen & Erase

The rpm utility operates in one of several primary modes specified by leading flags, typically combined with formatting modifiers (-v for verbose, -h for hash progress marks).

# Standard installation with progress hash marks
$ sudo rpm -ivh httpd-2.4.51-1.el9.x86_64.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:httpd-2.4.51-1.el9               ################################# [100%]

Critical rpm Modifier Flags

• -v: Verbose mode; displays detailed step-by-step progress.
• -h, --hash: Prints 50 hash marks (#) across the terminal to visualize unpacking progress.
• --test: Simulates the installation, upgrade, or removal without modifying disk state or the RPM database.
• --nodeps: Disables pre-transaction dependency checks. Forces installation or removal even if prerequisites are missing (dangerous).
• --force: Shorthand equivalent to --replacepkgs --replacefiles. Forces installation even if the package or its files already exist on disk.
• --replacepkgs: Reinstalls a package even if the database indicates it is already installed.
• --replacefiles: Installs files even if they conflict with or overwrite files owned by another installed package.
• --oldpackage: Allows downgrading a package to an older version during an rpm -U operation.
• --noscripts: Prevents execution of %pre, %post, %preun, and %postun maintainer scripts.

---

3. Querying the RPM Database: Installed Packages vs. RPM Files

Query mode (-q) interrogates either the local RPM database (/var/lib/rpm/) or an uninstalled .rpm package file when paired with the -p (package file) modifier.

Querying Installed Packages

# Query all installed packages on the system
$ rpm -qa | grep nginx

# Display detailed package metadata, license, architecture, and description
$ rpm -qi nginx

# List all files installed onto the filesystem by the nginx package
$ rpm -ql nginx

# Identify which package owns a specific file on the filesystem
$ rpm -qf /etc/nginx/nginx.conf
nginx-1.22.1-9.el9.x86_64

# List ONLY configuration files installed by the package
$ rpm -qc nginx

# List ONLY documentation files and man pages installed by the package
$ rpm -qd nginx

# Display embedded pre/post installation shell scripts
$ rpm -q --scripts nginx

# List virtual capabilities and features provided by the package
$ rpm -q --provides nginx

# List all prerequisites and capabilities required by the package
$ rpm -q --requires nginx   # OR: rpm -qR nginx

# Display change history log recorded by package maintainers
$ rpm -q --changelog nginx

Querying Uninstalled .rpm Package Files (-p Flag)

To query a package file that resides on disk but is not yet installed, you must append the -p flag and provide the full filename:

# View description and metadata of an uninstalled RPM file
$ rpm -qip httpd-2.4.51-1.el9.x86_64.rpm

# List all files that WILL be installed by the RPM archive
$ rpm -qlp httpd-2.4.51-1.el9.x86_64.rpm

# List configuration files inside the uninstalled archive
$ rpm -qcp httpd-2.4.51-1.el9.x86_64.rpm

# Check prerequisites required by the uninstalled archive
$ rpm -qp --requires httpd-2.4.51-1.el9.x86_64.rpm

---

4. Package Integrity Verification & Test Codes (rpm -V)

The verification mode (-V or --verify) compares file attributes on the live filesystem against the original metadata recorded in the RPM database during installation. If a file has not been altered, rpm -V outputs nothing. If differences exist, an 8-character status string is displayed.

# Verify a specific installed package
$ rpm -V httpd
S.5....T.  c /etc/httpd/conf/httpd.conf
..5......    /usr/sbin/httpd

# Verify ALL packages installed on the entire operating system
$ sudo rpm -Va

# Verify the package that owns a specific file
$ rpm -Vf /etc/ssh/sshd_config

Verification Test Code Reference Table

Each character position in the 8-character output string represents a specific attribute test:

💡 LPIC-1 Exam Fill-in-the-Blank Alert: In rpm -V output, 5 indicates that the MD5 or SHA256 checksum/digest failed (content changed), S indicates file size changed, and M indicates file permissions/mode changed.

---

5. Extracting Archive Files with rpm2cpio & cpio

When a critical system binary (such as /bin/ls or /lib64/libc.so.6) is accidentally deleted or corrupted, running a standard package manager may fail because the package manager itself depends on the missing binary. Administrators can extract individual files directly from an .rpm file without installing it or modifying /var/lib/rpm/ using rpm2cpio piped into cpio.

# Step 1: Create a temporary restoration directory
mkdir /tmp/rescue && cd /tmp/rescue

# Step 2: Convert RPM payload to cpio archive and extract
rpm2cpio /path/to/coreutils-8.32-34.el9.x86_64.rpm | cpio -idmv

# Step 3: Inspect extracted filesystem tree in /tmp/rescue
ls -l /tmp/rescue/usr/bin/ls

# Step 4: Copy the restored binary to its system location
sudo cp /tmp/rescue/usr/bin/ls /usr/bin/ls

cpio Extraction Flag Breakdown

• -i (--extract): Run cpio in input/extract mode.
• -d (--make-directories): Automatically create leading directories as needed.
• -m (--preserve-modification-time): Retain original file modification timestamps.
• -v (--verbose): Print names of files as they are unpacked.