Modify header digest of existing RPM packages

[Yash-Khatri]

Hi,

Is there any way to explicitly modify the existing header digest algo of the existing RPM packages?

Upon running the command rpm --checksig --verbose <package>.rpm it shows below output for my package.
please note that for header digest SHA1 is used.

<package>.rpm:
    Header V4 RSA/SHA256 Signature, key ID be1229cf: NOKEY
    Header SHA1 digest: OK (ce2010e132f77921d42ecaf2e2125655fa184668)
    V4 RSA/SHA256 Signature, key ID be1229cf: NOKEY
    MD5 digest: OK (8e1dfad3d8db689fd563d583bae2d956)

My requirement is to change this header digest to sha256 or similar.

p.s. I am building my packages on rhel6 and rhel7 systems.

Any help or suggestions are welcomed.

[DemiMarie]

Not with any command-line tool I am aware of. You could do it using librpm or any other library for reading and writing RPM packages.

[Yash-Khatri]

Thanks for your reply @DemiMarie :)
I think using other libraries than librpm might not be compatible/recommended with standard rpm. please correct me if I am wrong

If you have tried it earlier, could you please share some pointers to librpm functionalities which does the header digest part?

[mlschroe]

You can't change it to sha256, the element is defined to be a sha1 checksum. Newer rpms also add a "Header SHA256 digest", so you'll have both sha1 and sha256.

[pmatilai]

Just build the packages on a newer distro, you'll save yourself a whole lot of headaches. Really. Back in the days of "I have this box over here running distro X and I can't upgrade it because of Y" that was sometimes easier said than done, but containers changed that.

[DemiMarie]

Bingo. Run the code in a container on whatever box you are using.

[pmatilai]

Oh and actually, an even more lightweight option is just building with mock, it's available on those older rhel-versions too.

[Yash-Khatri]

Actually, it's not really just about the build environment, a bunch of other dependencies (on how we are consuming the packages) are why I am looking for alternatives, which can help in building with the current environment.

Thanks, @pmatilai, I will look into Mock as well.
Btw is mock recommended for prod scenarios?

[pmatilai]

mock is how all of RHEL (and Fedora) gets built.