AHMED ZBYR

AHMED ZBYR

Biker, EV Enthusiast

RPM (RPM Package Manager) is the low-level package management system used across Red Hat Enterprise Linux (RHEL), CentOS, Rocky Linux, AlmaLinux, Fedora, and SUSE Linux Enterprise. While high-level dependency resolvers (yum and dnf) are preferred for routine installations and updates from repositories, rpm is invaluable for querying package metadata, auditing file ownership, inspecting package scripts, and verifying package integrity on disk.

Quick Reference of Common rpm Flags

Flag Mode / Meaning
-i Install a new package
-U Upgrade a package (or install it if not already present)
-F Freshen (upgrade only if an older version is already installed)
-e Erase (uninstall) an installed package
-q Query the RPM database (or a .rpm file when combined with -p)
-V Verify installed package files against metadata in the RPM database
-v Verbose output
-h Print hash marks (#) to show installation progress
--test Perform a dry-run dependency and conflict check without making changes

1. Install, Upgrade, and Remove Packages

Install a Package (-ivh)

Use -ivh to install a local .rpm file. Add --test first to perform a dry-run check without modifying the system:

# Dry-run check
sudo rpm -ivh --test vim-common-7.4.629-5.el6.x86_64.rpm

# Install package
sudo rpm -ivh vim-common-7.4.629-5.el6.x86_64.rpm

(Note: When installing a kernel package manually with rpm, always use rpm -ivh rather than rpm -Uvh so the currently running kernel is kept as a fallback in GRUB.)

Upgrade a Package (-Uvh)

rpm -Uvh upgrades an existing package—or installs it if no previous version is present:

# Dry-run upgrade check
sudo rpm -Uvh --test vim-common-7.4.629-5.el6.x86_64.rpm

# Upgrade package
sudo rpm -Uvh vim-common-7.4.629-5.el6.x86_64.rpm

Erase / Uninstall a Package (-ev)

Remove an installed package by its package name (not the .rpm filename):

sudo rpm -ev vim-common

Erase Without Checking Dependencies (--nodeps)

sudo rpm -ev --nodeps vim-common

Caution: Avoid --nodeps in production unless you are immediately replacing the package in the same maintenance window; removing a shared dependency can break dependent binaries and system utilities. Prefer sudo yum remove or sudo dnf remove to see the full dependency tree first.

2. Query Installed Packages and Files

List All Installed Packages (-qa)

rpm -qa
rpm -qa | grep -i vim

List Recently Installed Packages (-qa --last)

Orders installed packages by installation timestamp (newest first):

rpm -qa --last | head -n 20

View Package Summary and Version Information (-qi)

rpm -qi vim-common

Find Which Package Owns a File (-qf)

Pass an absolute file path to discover which installed RPM provided it:

rpm -qf /etc/passwd
rpm -qf /bin/bash

List All Files Installed by a Package (-ql)

rpm -ql httpd

List Configuration Files for a Package (-qc / -qcf)

List only configuration files owned by a package (-qc) or owned by the package that provides a specific binary (-qcf):

rpm -qc httpd
rpm -qcf /usr/sbin/sshd

List Documentation Files for a Package (-qd)

rpm -qd httpd

3. Inspect Dependencies, Changelogs, and Scripts

Check Package Dependencies (-qR / -qpR)

Query dependencies of an installed package (-qR) or an uninstalled .rpm file (-qpR):

# Dependencies of an installed package
rpm -qR bash

# Dependencies required by a local .rpm archive before installing
rpm -qpR vim-common-7.4.629-5.el6.x86_64.rpm

Inspect Pre/Post-Install Scriptlets (--scripts)

Before installing a third-party RPM, inspect the shell scripts it will execute as root during installation or removal:

rpm -qp --scripts package.rpm

View Package Changelog (--changelog)

Useful for verifying whether a specific CVE backport is included in a Red Hat/CentOS package build:

rpm -q --changelog openssl | grep -i CVE-2022

4. Verify Package Integrity (-V and -K)

Verify Installed Files Against the RPM Database (-V)

rpm -V (or rpm -Va for all packages) compares file size (S), permissions/mode (M), SHA-256 digest (5), symlink target (L), ownership (U/G), and modification time (T) against the original package metadata:

rpm -V httpd

No output means every file in the package matches its installed state; modified configuration files typically show S.5....T. c /etc/httpd/conf/httpd.conf.

Verify GPG Signature of a Downloaded .rpm File (-K)

rpm -K vim-common-7.4.629-5.el6.x86_64.rpm

References

You May Also Enjoy