mediumsystemverified ✓rollback-safe
Enable GPG checking for repository metadata
repo-gpgcheck-enabled · RHEL ≥ 8 · 1 impl
Description
The repo_gpgcheck option should be enabled to verify GPG signatures on repository metadata in addition to individual packages.
Rationale
Verifying repository metadata ensures the package lists themselves have not been tampered with, preventing downgrade attacks and ensuring package integrity from source to installation.
Check → Remediate
Checkconfig_value
- path:
- /etc/dnf/dnf.conf
- key:
- repo_gpgcheck
- expected:
- 1
Remediateconfig_set
- path:
- /etc/dnf/dnf.conf
- key:
- repo_gpgcheck
- value:
- 1
- separator:
- =
Framework references
CIS
rhel8 1.2.1.3rhel9 1.2.1.3rhel10 1.2.1.3
NIST 800-53
CM-11(a)SI-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#packages#gpg#dnf#repository#security