rpmQuery, verify and install RPM packages directly
rpm is the low-level package tool under dnf and yum. It installs or removes single .rpm files without fetching dependencies, and above all it queries the local package database: which package owns a file, what a package installed, and whether files were changed since install.
rpm {-q|-V|-i|-U|-e|-K} [OPTIONS] [PACKAGE | FILE.rpm]...You inherited an Amazon Linux 2023 box and need to know where nginx's config came from and what else that package installed.
rpmThe RPM package manager: works on .rpm files and the database in /var/lib/rpm.
An .rpm file is a lead, a signature header (GPG signature and digests), a metadata header (name, epoch-version-release, requires, provides, file list with modes, owners and digests, scriptlets) and a compressed cpio payload. The installed state lives in the rpmdb under /var/lib/rpm (SQLite on AL2023 and RHEL 9, Berkeley DB before). rpm -q reads only that database, which is why queries are instant and don't need root. rpm -i opens a transaction: it checks the signature against keys imported with rpm --import, checks dependencies against what's installed, but never downloads anything, and that's the job of dnf. It then runs the %pre scriptlet, unpacks the payload, writes the header to the rpmdb and runs %post. rpm -V compares every file on disk with the size, mode, digest, owner and mtime stored in the header, which makes it a quick tamper and drift check. Config files marked %config(noreplace) are kept on upgrade, and the new version is saved as .rpmnew.
-qaList all installed packages (add --last to sort by install time)-q PKGIs PKG installed, and which version?-qf FILEWhich package owns FILE-qi PKGPackage info: version, install date, signature, build host-ql / -qc / -qd PKGAll files / config files / docs installed by PKG-qp FILE.rpmQuery a package file instead of the database-q --requires / --whatrequiresWhat it needs / what installed package needs it-q --scripts / --changelogShow install scriptlets / the changelog (CVE fixes)-V PKG / -VaVerify files against the database (one / all packages)-ivh FILE.rpmInstall with verbose output and hash progress bars-Uvh FILE.rpmUpgrade, or install if not present-e PKGErase (remove) a package-K FILE.rpmCheck a package file's digests and signaturesudo rpm -ivh --nodeps app.rpm to get past 'Failed dependencies'The package installs but can't run (missing libraries), and the rpmdb now has a broken dependency every later dnf run complains about.
sudo dnf install ./app.rpmrpm -Uvh on a kernel package-U replaces the running kernel's package, leaving no fallback if the new one doesn't boot.
sudo rpm -ivh kernel-*.rpm (install alongside), or dnf, which installs kernels side by sideTreating every line of rpm -Va as a problemConfig files (c) and log directories change by design.
rpm -Va | grep -v ' c /' # focus on binaries and librariesrpm -q nginx* in a directory that contains nginx filesThe shell expands the glob against local filenames first.
rpm -qa 'nginx*'Try these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox is Ubuntu (no rpm). Find which package owns /usr/bin/curl using the Debian equivalent of rpm -qf.
Write the rpm command that lists every file installed by the openssh-server package, and the one that lists only its config files.
Read this rpm -V line and say what changed: 'S.5....T. c /etc/ssh/sshd_config'.
Write the command that shows the ten most recently installed packages on an RPM system.
rpmQuery, verify and install RPM packages directly
rpm is the low-level package tool under dnf and yum. It installs or removes single .rpm files without fetching dependencies, and above all it queries the local package database: which package owns a file, what a package installed, and whether files were changed since install.
rpm {-q|-V|-i|-U|-e|-K} [OPTIONS] [PACKAGE | FILE.rpm]...You inherited an Amazon Linux 2023 box and need to know where nginx's config came from and what else that package installed.
rpmThe RPM package manager: works on .rpm files and the database in /var/lib/rpm.
An .rpm file is a lead, a signature header (GPG signature and digests), a metadata header (name, epoch-version-release, requires, provides, file list with modes, owners and digests, scriptlets) and a compressed cpio payload. The installed state lives in the rpmdb under /var/lib/rpm (SQLite on AL2023 and RHEL 9, Berkeley DB before). rpm -q reads only that database, which is why queries are instant and don't need root. rpm -i opens a transaction: it checks the signature against keys imported with rpm --import, checks dependencies against what's installed, but never downloads anything, and that's the job of dnf. It then runs the %pre scriptlet, unpacks the payload, writes the header to the rpmdb and runs %post. rpm -V compares every file on disk with the size, mode, digest, owner and mtime stored in the header, which makes it a quick tamper and drift check. Config files marked %config(noreplace) are kept on upgrade, and the new version is saved as .rpmnew.
-qaList all installed packages (add --last to sort by install time)-q PKGIs PKG installed, and which version?-qf FILEWhich package owns FILE-qi PKGPackage info: version, install date, signature, build host-ql / -qc / -qd PKGAll files / config files / docs installed by PKG-qp FILE.rpmQuery a package file instead of the database-q --requires / --whatrequiresWhat it needs / what installed package needs it-q --scripts / --changelogShow install scriptlets / the changelog (CVE fixes)-V PKG / -VaVerify files against the database (one / all packages)-ivh FILE.rpmInstall with verbose output and hash progress bars-Uvh FILE.rpmUpgrade, or install if not present-e PKGErase (remove) a package-K FILE.rpmCheck a package file's digests and signaturesudo rpm -ivh --nodeps app.rpm to get past 'Failed dependencies'The package installs but can't run (missing libraries), and the rpmdb now has a broken dependency every later dnf run complains about.
sudo dnf install ./app.rpmrpm -Uvh on a kernel package-U replaces the running kernel's package, leaving no fallback if the new one doesn't boot.
sudo rpm -ivh kernel-*.rpm (install alongside), or dnf, which installs kernels side by sideTreating every line of rpm -Va as a problemConfig files (c) and log directories change by design.
rpm -Va | grep -v ' c /' # focus on binaries and librariesrpm -q nginx* in a directory that contains nginx filesThe shell expands the glob against local filenames first.
rpm -qa 'nginx*'Try these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox is Ubuntu (no rpm). Find which package owns /usr/bin/curl using the Debian equivalent of rpm -qf.
Write the rpm command that lists every file installed by the openssh-server package, and the one that lists only its config files.
Read this rpm -V line and say what changed: 'S.5....T. c /etc/ssh/sshd_config'.
Write the command that shows the ten most recently installed packages on an RPM system.