RPM in Practice: Querying, Verifying, and Extracting Packages

DNF gets all the attention, but every package it manages is an RPM, and the rpm binary talks directly to the package database those files populate. That database records the files, permissions, digests, and scriptlets of every installed package — which makes rpm the fastest tool for three jobs sysadmins do constantly: finding out what is installed and who owns it, detecting files that changed behind package management's back, and pulling contents out of a package without installing it.

Querying: What Is This and Who Owns It

rpm -q bash
rpm -qi openssh-server
rpm -ql nginx | head
rpm -qf /etc/ssh/sshd_config
rpm -qa --last | head

Read these as one family: -q queries, and a second letter selects the output — i for metadata, l for the file list, f for "which package owns this file", a for all packages. The -qf form is the workhorse: point it at any file on the system and you learn instantly which package it belongs to and, by extension, which repository will update it. The --last sort answers the other urgent question after an incident: what changed on this machine recently? And before removing anything security-adjacent, rpm -q --whatrequires openssl tells you which installed packages depend on the library — cheaper than finding out by breaking them.

Verifying: Detecting Drift

The database stores a digest, size, owner, group, and mode for every file an RPM installed. Verification compares the disk against that record.

rpm -V openssh-server
rpm -Va

Output is a code per line: S means size changed, 5 the digest differs, M mode, U user, G group, T mtime — and c marks config files, while a deleted file shows up as missing. Silence is the good news here: no output means every file matches the database. Editing sshd_config produces an expected size, digest, and mtime change on a config file; an unexpected changed binary under /usr/bin with no config marker is a finding worth investigating, not dismissing. After a suspected compromise, rpm -Va is a fast, dependency-free integrity sweep that works even when fancier tooling is gone.

Extracting: Open the Box Without Installing

Sometimes you need a single file from a package on a machine where installing it is wrong — a specific library version, a stock config to diff against, a known-good binary for a rescue environment.

sudo dnf install -y dnf-plugins-core
mkdir /tmp/nginx-pkg && cd /tmp/nginx-pkg
dnf download nginx
rpm2cpio nginx-*.rpm | cpio -idmv
find . -type f | head

dnf download fetches the newest rpm without installing it; rpm2cpio converts the package into a cpio stream that extracts into the current directory. The tree lands relative to root — etc/, usr/, var/ — so you can read the stock config or copy out one binary without touching the live system. The same trick works for kernel rpms, letting you inspect the modules and config a new kernel will ship before it ever touches your bootloader.

Signatures: Trust Before Install

rpm -K somepackage-1.0-1.x86_64.rpm
rpm -qp --qf '%{NAME} %{VERSION} %{LICENSE}
' somepackage-1.0-1.x86_64.rpm

The -K check verifies GPG signatures and digests; "digests OK" on an unsigned package from a random source is not a trust statement. The -qp form reads metadata straight from the file — name, version, license, changelog — before it has touched your system at all, which makes it the polite way to inspect something a vendor emailed you.

When rpm, When dnf

Rule of thumb: rpm is a scalpel, dnf is the supply chain. Use rpm to inspect, verify, and extract; use dnf for anything that installs or removes, because only dnf resolves dependencies across all enabled repositories. Installing with rpm -ivh and untangling the dependency complaints by hand was a rite of passage in 2005 — dnf install ./package.rpm handles a local file with full dependency resolution today.

Takeaway: the RPM database is the ground truth of your system, and rpm is how you interrogate it — read-only, instant, and available even half-broken. Drill these on a scratch box: Netbay deploys VPS instances in under 60 seconds, and rpm -V plus rpm2cpio are worth having in your fingers, not your bookmarks — netbayhosts.in.