LFCS 51 🐧 Package Management — RPM - KandZ

⏱️ Estimated read: 12 min | |

RPM (Red Hat Package Manager) is the low-level package management tool for RHEL-based distributions—RHEL, CentOS, Fedora, Rocky Linux, AlmaLinux, and openSUSE. It is the foundation beneath DNF and YUM, and it is the tool that actually installs, upgrades, queries, and removes .rpm packages. The LFCS exam requires you to “search, install, verify, and maintain software packages or repositories,” and RPM is one of the two package management systems explicitly listed in the exam preparation materials . Understanding RPM is not optional for the exam, but it is also not sufficient on its own—the exam expects you to know when to use RPM directly and when to use the higher-level DNF.

The distinction is architectural. DNF resolves dependencies, downloads packages from repositories, and verifies signatures. RPM installs the package that DNF hands it. When you run dnf install nginx, DNF finds the package and its dependencies, downloads the .rpm files, and then calls the RPM library to install them . When you run rpm -ivh nginx.rpm, RPM installs that single file and does nothing about dependencies. If the package requires a library that is not installed, RPM fails and leaves the system in an inconsistent state until you manually install the dependency . This is why the documentation recommends using DNF for installation and RPM for querying and inspection .

Key point: RPM is the low-level tool that installs and queries individual .rpm files without resolving dependencies. rpm -ivh installs a local package, rpm -qa lists installed packages, rpm -qf finds the package that owns a file, and rpm -V verifies a package’s files against its metadata. DNF is the correct tool for installing from repositories because it resolves dependencies before calling RPM.

Why RPM exists as the low-level layer

The package format problem. An .rpm file is not just a compressed archive. It is a structured package that contains the binary files, the configuration files, the documentation, and the metadata: the package name, version, release, architecture, dependencies, file list, signature, and changelog . The RPM database (/var/lib/rpm) stores the metadata of every installed package, which is what allows rpm -qa to list what is installed and rpm -V to verify that the files still match what was installed.

The dependency problem. RPM records dependencies in the package metadata. When you install a package with rpm -ivh, RPM checks the dependencies against the installed packages. If a dependency is missing, RPM refuses to install and reports the missing library or package. It does not download or install the dependency. This is the boundary between RPM and DNF: RPM knows what is missing, but only DNF can fetch it .

The verification problem. RPM can verify that the files installed by a package have not been modified, deleted, or corrupted. rpm -V package compares the files on disk against the metadata stored in the RPM database—the file size, the permissions, the MD5 checksum, the modification time, and the owner/group. If a file has been tampered with, rpm -V reports it. This is the forensic tool that DNF does not replace .

The query problem. The RPM database is the source of truth for what is installed. rpm -qa lists every installed package. rpm -qi shows the metadata for a specific package. rpm -ql lists the files that a package installed. rpm -qf finds which package owns a specific file. rpm -qp queries a .rpm file without installing it . These queries work without a network connection and without a repository. They are the tools for inspecting the system’s state.

a. Installing, upgrading, and removing packages

The -i flag installs a package. The -U flag upgrades a package, installing it if it is not already present. The -F flag freshens a package, installing it only if an older version is already present. The -e flag removes a package.

# Install a local .rpm file
# -i: install
# -v: verbose (show progress)
# -h: hash marks (show progress bar)
sudo rpm -ivh package.rpm

# Upgrade a package (or install if not present)
# -U: upgrade
sudo rpm -Uvh package.rpm

# Freshen a package (upgrade only if an older version is installed)
# -F: freshen
sudo rpm -Fvh package.rpm

# Remove a package by name
# -e: erase
sudo rpm -e package_name

The -ivh combination is the standard install invocation. The -i tells RPM to install, the -v produces verbose output, and the -h prints a progress bar. Without -h, the installation produces no output until it finishes, which is confusing for a large package. The -Uvh is the upgrade form: if the package is not installed, it installs it; if it is installed, it upgrades it.

The --nodeps flag tells RPM to skip the dependency check. This is dangerous. The package installs, but it fails at runtime when the missing dependency is actually needed. The --force flag tells RPM to install even if the package is already installed or if the architecture does not match. Both flags are for recovery and debugging, not for normal installation .

The removal is rpm -e package_name. The package name is the name from the RPM database, not the filename. If the package is a dependency of another installed package, RPM refuses to remove it unless you use --nodeps, which leaves the dependent package broken.

b. Querying the RPM database

The query flags are the most useful part of RPM. They answer the questions that DNF cannot: what is installed, what files belong to a package, which package owns a file, and what the package metadata says.

# List all installed packages
# -q: query
# -a: all
rpm -qa

# List all installed packages, sorted by install time
# --last shows the most recently installed packages first
rpm -qa --last

# Show detailed information about an installed package
# -q: query
# -i: info
rpm -qi nginx

# List the files installed by a package
# -q: query
# -l: list
rpm -ql nginx

# Find which package owns a specific file
# -q: query
# -f: file
rpm -qf /usr/sbin/nginx

# Query a .rpm file without installing it
# -q: query
# -p: package file
rpm -qip package.rpm   # info
rpm -qlp package.rpm   # file list

The rpm -qf /path/to/file command is the one that resolves the “which package do I need to install to get this command?” question. If htpasswd is missing, rpm -qf $(which htpasswd) fails because the command does not exist. The correct approach is dnf provides /usr/bin/htpasswd, which searches the repository metadata. RPM’s -qf only works for files that are already installed .

The rpm -qip and rpm -qlp queries work on a .rpm file that has not been installed. This is useful for inspecting a package before installing it—checking its version, its dependencies, and the files it will place on the system.

c. Verifying and inspecting package integrity

The -V flag verifies a package’s installed files against the metadata in the RPM database. The output is a string of characters, each representing a different attribute that failed the check.

# Verify an installed package
# -V: verify
rpm -V nginx

# The output format:
# S.5....T.  c /etc/nginx/nginx.conf
#
# S: file size differs
# M: mode (permissions) differs
# 5: MD5 checksum differs
# D: device major/minor differs
# L: symlink path differs
# U: user ownership differs
# G: group ownership differs
# T: modification time differs
# P: capabilities differ
#
# The "c" means the file is a configuration file
# The file path follows the flags

A clean verification produces no output. A modified file produces a flag string and the file path. The c marker indicates a configuration file, which is expected to be modified by the administrator. A modified binary with a 5 flag (checksum differs) is a security concern—the binary has been changed since it was installed .

The rpm -qi and rpm -q --changelog queries show the package metadata and the changelog. The changelog is useful for determining whether a security patch has been applied to the installed version .

The rpm --setperms and rpm --setugids commands reset the permissions and ownership of a package’s files to the values recorded in the RPM database. This is the recovery tool for a system where the permissions have been accidentally changed.

Complete Example Session

The following session downloads a local .rpm file, inspects it, installs it, verifies it, and removes it.

# ============================================
# PART 1: QUERY A PACKAGE FILE WITHOUT INSTALLING
# ============================================
# Show the package metadata from the .rpm file
# -q: query
# -i: info
# -p: package file
rpm -qip ./nginx-1.24.0-1.el9.x86_64.rpm

# List the files that the package will install
# -q: query
# -l: list
# -p: package file
rpm -qlp ./nginx-1.24.0-1.el9.x86_64.rpm

# ============================================
# PART 2: INSTALL THE PACKAGE
# ============================================
# Install the local .rpm file
# -i: install
# -v: verbose
# -h: hash marks (progress)
sudo rpm -ivh ./nginx-1.24.0-1.el9.x86_64.rpm

# ============================================
# PART 3: QUERY THE INSTALLED PACKAGE
# ============================================
# Confirm the package is installed
rpm -qa | grep nginx

# Show the installed package's metadata
rpm -qi nginx

# Find which package owns the nginx binary
rpm -qf /usr/sbin/nginx

# ============================================
# PART 4: VERIFY THE PACKAGE
# ============================================
# Verify the package files against the RPM database
# A clean verification produces no output
rpm -V nginx

# Modify a file to see the verification output
# (do not do this on a production system)
# echo "modified" | sudo tee -a /etc/nginx/nginx.conf
# rpm -V nginx
# Output: S.5....T.  c /etc/nginx/nginx.conf

# ============================================
# PART 5: REMOVE THE PACKAGE
# ============================================
# Remove the package by name
# -e: erase
sudo rpm -e nginx

# Confirm the package is removed
rpm -qa | grep nginx

The five parts cover querying a package file, installing it, querying the installed package, verifying its files, and removing it. What the session demonstrates is that RPM operates on individual packages without resolving dependencies, and the query and verify flags are the tools for inspecting the system’s state.

Quick Reference

Install and Remove

Command	Effect
`rpm -ivh pkg.rpm`	Install a local package
`rpm -Uvh pkg.rpm`	Upgrade (or install)
`rpm -Fvh pkg.rpm`	Freshen (upgrade only)
`rpm -e pkg`	Remove a package
`rpm -e --nodeps pkg`	Remove without dependency check

Query Installed

Command	Effect
`rpm -qa`	List all installed packages
`rpm -qa --last`	List by install time
`rpm -qi pkg`	Show package metadata
`rpm -ql pkg`	List files in package
`rpm -qf /path`	Find package owning a file

Query Package File

Command	Effect
`rpm -qip pkg.rpm`	Show metadata from file
`rpm -qlp pkg.rpm`	List files in file
`rpm -qp --requires pkg.rpm`	Show dependencies

Verify

Command	Effect
`rpm -V pkg`	Verify installed files
`rpm -Va`	Verify all packages
`rpm --setperms pkg`	Reset file permissions
`rpm --setugids pkg`	Reset file ownership

Best Practices

✅ Do This:

# Query a package file before installing it
rpm -qip package.rpm

# Use DNF for installation from repositories
dnf install nginx

# Use RPM for querying and verification
rpm -qf /usr/sbin/nginx
rpm -V nginx

❌ Don’t Do This:

# Install without checking dependencies
rpm -ivh package.rpm # may fail on missing deps

# Use --nodeps to force installation
rpm -ivh --nodeps package.rpm # broken runtime

# Use RPM to install from repositories
rpm -ivh nginx # RPM does not download

Common Pitfalls

Pitfall	Why It Happens	Fix
Failed dependencies	Missing library or package	Use `dnf install` instead
Package already installed	Used `-i` instead of `-U`	Use `-Uvh` or `--replacepkgs`
Cannot remove package	Another package depends on it	Remove dependents first
`rpm -qf` fails	File not from a package	Use `dnf provides`
Verification shows `5`	File checksum changed	Investigate; may be tampering

Real-World Examples

1. Install a local package

sudo rpm -ivh package.rpm

2. Upgrade a package

sudo rpm -Uvh package.rpm

3. Remove a package

sudo rpm -e package_name

4. List installed packages

rpm -qa | grep nginx

5. Show package info

rpm -qi nginx

6. List package files

rpm -ql nginx

7. Find owner of a file

rpm -qf /usr/sbin/nginx

8. Verify a package

rpm -V nginx

9. Query a package file

rpm -qip package.rpm

10. Show install time

rpm -qa --last

Visual

RPM vs DNF

┌──────────────────────────────────────────────┐
│  DNF                                         │
│  - resolves dependencies                     │
│  - downloads from repositories               │
│  - verifies signatures                       │
│  - calls RPM library to install              │
│         │                                    │
│         ▼                                    │
│  RPM                                         │
│  - installs the .rpm file                    │
│  - updates the RPM database                  │
│  - verifies files against metadata           │
└──────────────────────────────────────────────┘

Install Flow

┌──────────────────────────────────────────────┐
│  rpm -ivh package.rpm                        │
│         │                                    │
│         ▼                                    │
│  Check dependencies                          │
│  ├─ all present → install                    │
│  └─ missing → fail with dependency error     │
└──────────────────────────────────────────────┘

Verification Flags

┌──────────────────────────────────────────────┐
│  S.5....T.  c /etc/nginx/nginx.conf          │
│  │ │ │ │ │  │ │                             │
│  │ │ │ │ │  │ └── path                       │
│  │ │ │ │ │  └──── c = config file            │
│  │ │ │ │ └─────── T = mtime differs          │
│  │ │ │ └───────── 5 = checksum differs       │
│  │ │ └─────────── . = mode unchanged         │
│  │ └───────────── . = no other flags         │
│  └─────────────── S = size differs           │
└──────────────────────────────────────────────┘

Summary

Item	Value
RPM	Low-level package manager
Package format	`.rpm`
Install	`rpm -ivh`
Upgrade	`rpm -Uvh`
Remove	`rpm -e`
List installed	`rpm -qa`
Find file owner	`rpm -qf`
Verify	`rpm -V`
Dependency resolution	No (use DNF)
Database	`/var/lib/rpm`

Key takeaways:

RPM is the low-level tool. It installs and queries individual .rpm files. It does not resolve dependencies, download from repositories, or verify signatures. Those are DNF’s responsibilities .
Use RPM for queries and verification. rpm -qa, rpm -qi, rpm -ql, rpm -qf, and rpm -V are the tools for inspecting the system’s installed state and detecting tampering .
Use DNF for installation. dnf install resolves dependencies before calling RPM. rpm -ivh on a package with missing dependencies fails and leaves the system in an inconsistent state.
The RPM database is the source of truth. It records what is installed, what files each package owns, and what the files should look like. The rpm -V verification compares the disk against the database .
rpm -qf only works for installed files. To find the package that provides a missing command, use dnf provides /path/to/command .

Remember: RPM is the foundation of package management on RHEL-based systems, but it is not the tool you use for everyday installation. The everyday tool is DNF, which resolves dependencies and downloads from repositories. RPM is the tool you use when you have a local .rpm file and no repository, when you need to inspect what a package contains before installing it, when you need to find which package owns a file, and when you need to verify that the installed files have not been modified. The LFCS exam expects both: the DNF commands for installation and the RPM commands for querying and verification. The distinction between the two is the difference between managing the system’s packages and inspecting the system’s state.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!