head     1.1;
branch   1.1.1;
access   ;
symbols  MAXIMUM_RPM_1_0:1.1.1.1 VENDOR:1.1.1;
locks    ; strict;
comment  @# @;


1.1
date     2001.08.28.12.07.10;  author rse;  state Exp;
branches 1.1.1.1;
next     ;

1.1.1.1
date     2001.08.28.12.07.10;  author rse;  state Exp;
branches ;
next     ;


desc
@@



1.1
log
@Initial revision
@
text
@  <chapter id="ch-rpm-verify">
    <title>Using RPM to Verify Installed Packages</title>
    <!-- label: verify-chapter -->

    <indexterm>
      <primary><command>rpm -V</command></primary>
    </indexterm>

    <table id="tb-rpm-verify-rpm-v-syntax">
      <title><command>rpm -V</command> Command Syntax</title>
      <tgroup cols="3">
        <colspec colnum="1" colname="option">
        <colspec colnum="2" colname="description">
        <colspec colnum="3" colname="pageref">
        <spanspec namest="option" nameend="pageref" spanname="spanall">
        <spanspec namest="option" nameend="description" spanname="span12">
        <spanspec namest="description" nameend="pageref" spanname="span23">
        <tbody>

          <row>
            <entry spanname="spanall" align="center">
              <command>rpm -V</command> or (<command>--verify</command>, or
              <command>-y</command>) <emphasis>options</emphasis>
            </entry>
          </row>

          <row>
            <entry spanname="span12" align="center">
              Package Selection Options
            </entry>
            <entry>
              Page
            </entry>
          </row>

          <row>
            <entry>
              <filename>pkg1</filename> &hellip; <filename>pkgN</filename>
            </entry>
            <entry>
              Verify named package(s)
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-package-label">
            </entry>
          </row>

          <row>
            <entry>
              <command>-p <replaceable>&lt;file&gt;</replaceable></command>
            </entry>
            <entry>
              Verify against package file
              <command><replaceable>&lt;file&gt;</replaceable></command>
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-p-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>-f <replaceable>&lt;file&gt;</replaceable></command>
            </entry>
            <entry>
              Verify package owning
              <command><replaceable>&lt;file&gt;</replaceable></command>
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-f-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>-a</command>
            </entry>
            <entry>
              Verify all installed packages
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-a-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>-g <replaceable>&lt;group&gt;</replaceable></command>
            </entry>
            <entry>
              Verify packages belonging to group
              <command><replaceable>&lt;group&gt;</replaceable></command>
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-g-option">
            </entry>
          </row>

          <row>
            <entry spanname="span12" align="center">
              Verify-specific Options
            </entry>
            <entry>
              Page
            </entry>
          </row>

          <row>
            <entry>
              <command>--noscripts</command>
            </entry>
            <entry>
              Do not execute verification script
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-noscripts-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>--nodeps</command>
            </entry>
            <entry>
              Do not verify dependencies
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-nodeps-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>--nofiles</command>
            </entry>
            <entry>
              Do not verify file attributes
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-nofiles-option">
            </entry>
          </row>

          <row>
            <entry spanname="span12" align="center">
              General Options
            </entry>
            <entry>
              Page
            </entry>
          </row>

          <row>
            <entry>
              <command>-v</command>
            </entry>
            <entry>
              Display additional information
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-v-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>-vv</command>
            </entry>
            <entry>
              Display debugging information
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-vv-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>--root <replaceable>&lt;path&gt;</replaceable></command>
            </entry>
            <entry>
              Set alternate root to
              <command><replaceable>&lt;path&gt;</replaceable></command>
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-root-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>--rcfile <replaceable>&lt;rcfile&gt;</replaceable></command>
            </entry>
            <entry>
              Set alternate rpmrc file to
              <command><replaceable>&lt;rcfile&gt;</replaceable></command>
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-rcfile-option">
            </entry>
          </row>

          <row>
            <entry>
              <command>--dbpath <replaceable>&lt;path&gt;</replaceable></command>
            </entry>
            <entry>
              Use <command><replaceable>&lt;path&gt;</replaceable></command> to find
              the RPM database
            </entry>
            <entry>
              <xref linkend="s2-rpm-verify-dbpath-option">
            </entry>
          </row>
        </tbody>
      </tgroup>
    </table>

    <sect1 id="s1-rpm-verify-what-it-does">
      <title><command>rpm -V</command> &mdash; What Does it Do?</title>
      <!-- label: rpm-V -->

      <indexterm>
        <primary><command>rpm -V</command></primary>
        <secondary>what it does</secondary>
      </indexterm>

      <para>
        From time to time, it's necessary to make sure that everything on your
        system is "OK".  Are you sure the packages you've installed are still
        configured properly?  Have there been any changes made that you don't
        know about?  Did you mistakenly start a recursive delete in
        <filename>/usr</filename> and now have to assess the damage?
      </para>

      <para>
        RPM can help.  It can alert you to changes made to any of the files
        installed by RPM.  Also, if a package requires capabilities provided by
        another package, it can make sure the other package is installed, too.
      </para>

      <para>
        The command <command>rpm -V</command> (The options <command>-y</command>
        and <command>--verify</command> are equivalent) verifies an installed
        package.  Before we see how this is done, let's take a step back and
        look at the big picture.
      </para>

      <para>
        Every time a package is installed, upgraded, or erased, the changes are
        logged in RPM's database.  It's necessary for RPM to keep track of this
        information; otherwise it wouldn't be able to perform these operations
        correctly.  You can think of the RPM database (and the disk space it
        consumes) as being the "price of admission" for the easy package
        management that RPM provides.
        <footnote>
          <para>
            Actually, the price is fairly low.  For a completely RPM-based Linux
            distribution, it would be unusual to have a database over 5MB in
            size.
          </para>
        </footnote>
      </para>

      <para>
        The RPM database reflects the configuration of the system on which it
        resides.  When RPM accesses the database to see how files should be
        manipulated during an install, upgrade, or erase, it is using the
        database as a mirror of the system's configuration.
      </para>

      <para>
        However, we can also use the system configuration as a mirror of the RPM
        database.  What does this "backward" view give us?  What purpose would
        be served?
      </para>

      <para>
        The purpose would be to see if the system configuration accurately
        reflects the contents of the RPM database.  If the system configuration
        <emphasis>doesn't</emphasis> match the database, then we can reach one
        of two conclusions:

        <orderedlist>
          <listitem>
            <para>
              The RPM database has become corrupt.  The system configuration is
              unchanged.
            </para>
          </listitem>

          <listitem>
            <para>
              The RPM database is intact.  The system configuration has changed.
            </para>
          </listitem>
        </orderedlist>
      </para>

      <para>
        While it would be foolish to state that an RPM database has
        <emphasis>never</emphasis> become corrupt, it is a sufficiently rare
        occurrence that the second conclusion is much more likely.  So RPM gives
        us a powerful verification tool, essentially for free.
      </para>

      <sect2 id="s2-rpm-verify-what-does-it-verify">
        <title>What Does it Verify?</title>

        <indexterm>
          <primary><command>rpm -V</command></primary>
          <secondary>what it verifies</secondary>
        </indexterm>

        <para>
          It would be handy if RPM did nothing more than verify that every file
          installed by a package actually exists on your system.  In reality,
          RPM does much more.  It makes sure that if a package depends on other
          packages to provide certain capabilities, the necessary packages are,
          in fact, installed.  If the package builder created one, RPM will also
          run a special verification script that can verify aspects of the
          package's installation that RPM cannot.
        </para>

        <para>
          Finally, every file installed by RPM is examined.  No less than
          <emphasis>nine</emphasis> different attributes of each file can be
          checked.  Here is the list of attributes:

          <itemizedlist mark="bullet">
            <listitem>
              <para>
                Owner
              </para>
            </listitem>

            <listitem>
              <para>
                Group
              </para>
            </listitem>

            <listitem>
              <para>
                Mode
              </para>
            </listitem>

            <listitem>
              <para>
                MD5 Checksum
              </para>
            </listitem>

            <listitem>
              <para>
                Size
              </para>
            </listitem>

            <listitem>
              <para>
                Major Number
              </para>
            </listitem>

            <listitem>
              <para>
                Minor Number
              </para>
            </listitem>

            <listitem>
              <para>
                Symbolic Link String
              </para>
            </listitem>

            <listitem>
              <para>
                Modification Time
              </para>
            </listitem>
          </itemizedlist>
        </para>

        <para>
          Let's take a look at each of these attributes and why they are good
          things to check:
        </para>

        <sect3 id="s3-rpm-verify-file-ownership">
          <title>File Ownership</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
          </indexterm>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>file ownership</tertiary>
          </indexterm>

          <para>
            Most operating systems today keep track of each file's creator.
            This is done primarily for resource accounting.  Linux and UNIX also
            use file ownership to help determine access rights to the file.  In
            addition, some files, when executed by a user, can temporarily
            change the user's ID, normally to a more privileged ID. Therefore,
            any change of file ownership may have far reaching effects on data
            security and system availability.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-file-group">
          <title>File Group</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>file group</tertiary>
          </indexterm>

          <para>
            In a similar manner to file ownership, a "group" specification is
            attached to each file.  Primarily used for determining access
            rights, a file's group specification can also become a user's group
            ID, should that user execute the file's contents.  Therefore, any
            changes in a file's group specification are important, and should be
            monitored.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-file-mode">
          <title>File Mode</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>file mode</tertiary>
          </indexterm>

          <para>
            Encompassing the file's "permissions", the mode is a set of bits
            that specifies permitted access for the file's owner, group members,
            and everyone else.  Even more important are two additional bits that
            determine whether a user's group or user ID should be changed if
            they execute the program contained in the file.  Since these little
            bombshells can let any user become <filename>root</filename> for the
            duration of the program, it pays to be extra careful with a file's
            permissions.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-md5-checksum">
          <title>MD5 Checksum</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>MD5 checksum</tertiary>
          </indexterm>

          <para>
            The MD5 checksum of a file is simply a 128-bit number that is
            mathematically derived from the contents of the file.  The MD5
            algorithm was designed by Ron Rivest, the "R" in the popular RSA
            public-key encryption algorithm.  The "MD" in "MD5" stands for
            <emphasis>Message Digest</emphasis>, which is a pretty accurate
            description of what it does.
          </para>

          <para>
            Unlike literary digests, an MD5 checksum conveys no information
            about the contents of the original file.  However, it possesses one
            unique trait:

            <itemizedlist mark="bullet">
              <listitem>
                <para>
                  <emphasis>Any</emphasis> change to the file, no matter how
                  small, results in a change to the MD5 checksum.
                  <footnote>
                    <para>
                      From a strictly theoretical standpoint, this is not
                      entirely true.  Using the lingo of cryptologists, it is
                      believed to be "computationally infeasible" to find two
                      messages that produce the same MD5 checksum.
                    </para>
                  </footnote>
                </para>
              </listitem>
            </itemizedlist>
          </para>

          <para>
            RPM creates MD5 checksums of all files it manipulates, and stores
            them in its database.  For all intents and purposes, if one of these
            files is changed, the MD5 checksum will change, and RPM will detect
            it.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-file-size">
          <title>File Size</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>file size</tertiary>
          </indexterm>

          <para>
            As if the use of MD5 isn't enough, RPM also keeps track of file
            sizes.  A difference of even one byte more or less will not go
            unnoticed.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-major-number">
          <title>Major Number</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>major number</tertiary>
          </indexterm>

          <para>
            Device character and block files possess a major number.  The major
            number is used to communicate information to the device driver
            associated with the special file.  For instance, under Linux the
            special files for SCSI disk drives should have a major number of 8,
            while the major number for an IDE disk drive's special file would be
            3.  As you can imagine, any change to a file's major number can have
            disastrous effects, and is tracked by RPM.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-minor-number">
          <title>Minor Number</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>minor number</tertiary>
          </indexterm>

          <para>
            A file's minor number is similar in concept to the major number, but
            conveys different information to the device driver.  In the case of
            disk drives, this information can consist of a unit identifier.
            Should the minor number change, RPM will detect it.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-symbolic-link">
          <title>Symbolic Link</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>symbolic link</tertiary>
          </indexterm>

          <para>
            If the file in question is really a symbolic link, the text string
            containing the name of the linked-to file is checked.
          </para>
        </sect3>

        <sect3 id="s3-rpm-verify-modification-time">
          <title>Modification Time</title>

          <indexterm>
            <primary><command>rpm -V</command></primary>
            <secondary>attributes verified</secondary>
            <tertiary>modification time</tertiary>
          </indexterm>

          <para>
            Most operating systems keep track of the date and time that a file
            was last modified.  RPM uses this to its advantage by keeping
            modification times in its database.
          </para>
        </sect3>
      </sect2>
    </sect1>

    <sect1 id="s1-rpm-verify-output">
      <title>When Verification Fails &mdash; <command>rpm -V</command>
      Output</title>

      <indexterm>
        <primary><command>rpm -V</command></primary>
        <secondary>output of</secondary>
      </indexterm>

      <para>
        When verifying a package, RPM produces output <emphasis>only</emphasis>
        if there is a verification failure.  When a file fails verification, the
        format of the output is a bit cryptic, but it packs all the information
        you need into one line per file.  Here is the format:

        <screen width="60">
<computeroutput>
SM5DLUGT c <replaceable>&lt;file&gt;</replaceable>
</computeroutput>
        </screen>
      </para>

      <para>
        Where:

        <itemizedlist mark="bullet">
          <listitem>
            <para>
              <computeroutput>S</computeroutput> is the file size.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>M</computeroutput> is the file's mode.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>5</computeroutput> is the MD5 checksum of the
              file.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>D</computeroutput> is the file's major and minor
              numbers.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>L</computeroutput> is the file's symbolic link
              contents.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>U</computeroutput> is owner of the file.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>G</computeroutput> is the file's group.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>T</computeroutput> is the modification time of the
              file.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput>c</computeroutput> appears only if the file is a
              configuration file.
              <indexterm>
                <primary>config files</primary>
              </indexterm>
              This is handy for quickly identifying config files, as they are
              very likely to change, and therefore, very
              <emphasis>unlikely</emphasis> to verify successfully.
            </para>
          </listitem>

          <listitem>
            <para>
              <computeroutput><replaceable>&lt;file&gt;</replaceable></computeroutput>
              is the file that failed verification.  The complete path is listed
              to make it easy to find.
            </para>
          </listitem>
        </itemizedlist>
      </para>

      <para>
        It's unlikely that <emphasis>every</emphasis> file attribute will fail
        to verify, so each of the eight attribute flags will only appear if
        there is a problem.  Otherwise, a "<computeroutput>.</computeroutput>"
        will be printed in that flag's place.  Let's look at an example or two:

        <screen width="60">
<computeroutput>
.M5....T   /usr/X11R6/lib/X11/fonts/misc/fonts.dir
</computeroutput>
        </screen>
      </para>

      <para>
        In this case, the mode, MD5 checksum, and modification time for the
        specified file have failed to verify.  The file is not a config file
        (Note the absence of a "<computeroutput>c</computeroutput>" between the
        attribute list and the filename).

        <screen width="60">
<computeroutput>
S.5....T c /etc/passwd
</computeroutput>
        </screen>
      </para>

      <para>
        Here, the size, checksum, and modification time of the system password
        file have all changed.  The "<computeroutput>c</computeroutput>"
        indicates that this is a config file.

        <screen width="60">
<computeroutput>
missing    /var/spool/at/spool
</computeroutput>
        </screen>
      </para>

      <para>
        This last example illustrates what RPM does when a file, that should be
        there, is missing entirely.
      </para>

      <sect2 id="s2-rpm-verify-verification-failure-messages">
        <title>Other Verification Failure Messages</title>

        <para>
          When <command>rpm -V</command> finds other problems, the output is a
          bit easier to understand:

          <screen width="60">
<prompt># </prompt><userinput>rpm -V blather</userinput>
<computeroutput>
Unsatisfied dependencies for blather-7.9-1: bother &gt;= 3.1
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          It's pretty easy to see that the <filename>blather</filename> package
          requires at least version 3.1 of the <filename>bother</filename>
          package.
        </para>

        <para>
          The output from a package's verification script is a bit harder to
          categorize, as the script's contents, as well as its messages, are
          entirely up to the package builder.
        </para>
      </sect2>
    </sect1>

    <sect1 id="s1-rpm-verify-what-to-verify">
      <title>Selecting What to Verify, and How</title>

      <indexterm>
        <primary><command>rpm -V</command></primary>
        <secondary>options</secondary>
      </indexterm>

      <para>
        There are several ways to verify packages installed on your system.  If
        you've taken a look at RPM's query command, you'll find that many of
        them are similar.  Let's start with the simplest method of specifying
        packages &mdash; the package label.
      </para>

      <sect2 id="s2-rpm-verify-package-label">
        <title>
          The Package Label &mdash; Verify an Installed Package Against the RPM
          Database
        </title>
        <!-- label: verify-pkg-name -->

        <indexterm>
          <primary>package label</primary>
        </indexterm>

        <para>
          You can simply follow the <command>rpm -V</command> command with all
          or part of a package label.  As with every other RPM command that
          accepts package labels, you'll need to carefully specify each part of
          the label you include.  Keep in mind that package names are
          case-sensitive, so <command>rpm -V PackageName</command> and
          <command>rpm -V packagename</command> are <emphasis>not</emphasis> the
          same.  Let's verify the <filename>initscripts</filename> package:

          <screen width="60">
<prompt># </prompt><userinput>rpm -V initscripts</userinput>
<prompt># </prompt>
          </screen>
        </para>

        <para>
          While it looks like RPM didn't do anything, the following steps were
          performed:

          <itemizedlist mark="bullet">
            <listitem>
              <para>
                For every file in the package, RPM checked the nine file
                attributes that were discussed above.
              </para>
            </listitem>

            <listitem>
              <para>
                If the package was built with dependencies, the RPM database was
                searched to ensure the packages that satisfy those dependencies
                were installed.
              </para>
            </listitem>

            <listitem>
              <para>
                If the package was built with a verification script, that script
                was executed.
              </para>
            </listitem>
          </itemizedlist>
        </para>

        <para>
          In our example, each of these steps was performed without error
          &mdash; the package verified successfully.  Remember, with
          <command>rpm -V</command> you'll only see output if a package fails to
          verify.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-a-option">
        <title>
          <command>-a</command> &mdash; Verify All Installed Packages Against
          the RPM Database
        </title>
        <!-- label: verify-a -->

        <indexterm>
          <primary><command>-a</command> option</primary>
        </indexterm>

        <para>
          If you add <command>-a</command> to <command>rpm -V</command>, you can
          easily verify every installed package on your system.  It might take a
          while, but when it's done, you'll know exactly what's been changed on
          your system:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Va</userinput>
<computeroutput>
.M5....T   /usr/X11R6/lib/X11/fonts/misc/fonts.dir
missing    /var/spool/at/.lockfile
missing    /var/spool/at/spool
S.5....T   /usr/lib/rhs/glint/icon.pyc
..5....T c /etc/inittab
..5.....   /usr/bin/loadkeys
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          Don't be too surprised if <command>rpm -Va</command> turns up a
          surprising number of files that failed verification.  RPM's
          verification process is <emphasis>very</emphasis> strict!  In many
          cases, the changes flagged don't indicate problems &mdash; they are
          only an indication of your system's configuration being different than
          what the builders of the installed packages had on
          <emphasis>their</emphasis> system.  Also, some attributes change
          during normal system operation.  However, it would be wise to check
          into each verification failure, just to make sure.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-f-option">
        <title>
          <command>-f <replaceable>&lt;file&gt;</replaceable></command> &mdash;
          Verify the Package Owning
          <command><replaceable>&lt;file&gt;</replaceable></command> Against the
          RPM Database
        </title>
        <!-- label: verify-f -->

        <indexterm>
          <primary><command>-f</command> option</primary>
        </indexterm>

        <para>
          Imagine this: you're hard at work when a program you've used a million
          times before suddenly stops working.  What do you do?  Well, before
          using RPM, you probably tried to find other files associated with that
          program and see if they had changed recently.
        </para>

        <para>
          Now you can let RPM do at least part of that sleuthing for you.
          Simply direct RPM to verify the package owning the ailing program:

          <screen width="60">
<prompt>% </prompt><userinput>rpm -Vf /sbin/cardmgr</userinput>
<computeroutput>
S.5....T c /etc/sysconfig/pcmcia
</computeroutput>
<prompt>% </prompt>
          </screen>

          Hmmmm.  Looks like a config file was recently changed.
        </para>

        <para>
          This isn't to say that using RPM to verify a package will always get
          you out of trouble, but it's such a quick step it should be one of the
          first things you try.  Here's an example of <command>rpm -Vf</command>
          not working out as well:

          <screen width="60">
<prompt>% </prompt><userinput>rpm -Vf /etc/blunder</userinput>
<computeroutput>
file /etc/blunder is not owned by any package
</computeroutput>
<prompt>% </prompt>
          </screen>
        </para>

        <para>
          (Note that the issue surrounding RPM and symbolic links mentioned in
          <xref linkend="s4-rpm-query-tricky-detail"> also applies to
          <command>rpm -Vf</command>.  Watch those symlinks!)
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-p-option">
        <title>
          <command>-p <replaceable>&lt;file&gt;</replaceable></command> &mdash;
          Verify Against a Specific Package File
        </title>
        <!-- label: verify-p -->

        <indexterm>
          <primary><command>-p</command> option</primary>
        </indexterm>

        <para>
          Unlike the previous options to <command>rpm -V</command>, each of
          which verified one or more packages against RPM's database, the
          <command>-p</command> option performs the same verification, but
          against a package file.  Why on earth would you want to do this when
          the RPM database is sitting there just waiting to be used?
        </para>

        <para>
          Well, what if you didn't <emphasis>have</emphasis> an RPM database?
          While it isn't a common occurrence, power failures, hardware problems,
          and inadvertent deletions (along with non-existent backups) can leave
          your system "sans database".  Then your system hiccups &mdash; what do
          you do now?
        </para>

        <para>
          This is where a CD full of package files can be worth its weight in
          gold.  Simply mount the CD and verify to your heart's content:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vp /mnt/cdrom/RedHat/RPMS/i386/adduser-1.1-1.i386.rpm</userinput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          Whatever else might be wrong with this system, at least we can add new
          users.  But what if you have <emphasis>many</emphasis> packages to
          verify?  It would be a very slow process doing it one package at a
          time.  That's where the next option comes in handy&hellip;
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-g-option">
        <title>
          <command>-g <replaceable>&lt;group&gt;</replaceable></command> &mdash;
          Verify Packages Belonging To
          <command><replaceable>&lt;group&gt;</replaceable></command>
        </title>
        <!-- label: verify-g -->

        <indexterm>
          <primary><command>-g</command> option</primary>
        </indexterm>

        <para>
          When a package is built, the package builder must classify the
          package, grouping it with other packages that perform similar
          functions.  RPM gives you the ability to verify installed packages
          based on their groups.  For example, there is a group known as
          <filename>Shells</filename>.  This group consists of packages that
          contain, strangely enough, shells.  Let's verify the proper
          installation of every shell-related package on the system:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vg Shells</userinput>
<computeroutput>
missing    /etc/bashrc
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          One thing to keep in mind is that group specifications are
          case-sensitive.  Issuing the command <command>rpm -Vg shells</command>
          wouldn't verify many packages:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vg shells</userinput>
<computeroutput>
group shells does not contain any packages
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-nodeps-option">
        <title>
          <command>--nodeps</command>: Do Not Check Dependencies During
          Verification
        </title>
        <!-- label: verify- -nodeps -->

        <indexterm>
          <primary><command>--nodeps</command> option</primary>
        </indexterm>

        <para>
          When the <command>--nodeps</command> option is added to a verify
          command, RPM will bypass its dependency verification processing.  In
          this example, we've added the <command>-vv</command> option to so we
          can watch RPM at work:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv rpm</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 2341208
D: dependencies: looking for libz.so.1
D: dependencies: looking for libdb.so.2
D: dependencies: looking for libc.so.5
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          As we can see, there are three different capabilities that the
          <command>rpm</command> package requires:

          <itemizedlist mark="bullet">
            <listitem>
              <para>
                <filename>libz.so.1</filename>
              </para>
            </listitem>

            <listitem>
              <para>
                <filename>libdb.so.2</filename>
              </para>
            </listitem>

            <listitem>
              <para>
                <filename>libc.so.5</filename>
              </para>
            </listitem>
          </itemizedlist>
        </para>

        <para>
          If we add the <command>--nodeps</command> option, the dependency
          verification of the three capabilities is no longer performed:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv --nodeps rpm</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 2341208
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          The line <computeroutput>D: verifying record number
          2341208</computeroutput> indicates that RPM's normal file-based
          verification proceeded normally.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-noscripts-option">
        <title>
          <command>--noscripts</command>: Do Not Execute Verification Script
        </title>
        <!-- label: verify- -noscripts -->

        <indexterm>
          <primary><command>--noscripts</command> option</primary>
        </indexterm>

        <para>
          Adding the <command>--noscripts</command> option to a verify command
          prevents execution of the verification scripts of each package being
          verified.  In the following example, the package verification script
          is executed:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv bother</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 616728
D: verify script found - running from file /var/tmp/rpm-321.vscript
+ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
+ export PATH
+ echo This is the bother 3.5 verification script
This is the bother 3.5 verification script
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          While the actual script is not very interesting, it did execute when
          the package was being verified.  In the next example, we'll use the
          <command>--noscripts</command> option to prevent its execution:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv --noscripts bother</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 616728
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          As expected, the output is identical to the prior example &mdash;
          minus the lines dealing with the verification script, of course.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-nofiles-option">
        <title>
          <command>--nofiles</command>: Do Not Verify File
          Attributes
        </title>
        <!-- label: verify- -nofiles -->

        <indexterm>
          <primary><command>--nofiles</command> option</primary>
        </indexterm>

        <para>
          The <command>--nofiles</command> option disables RPM's file-related
          verification processing.  When this option is used, only the
          verification script and dependency verification processing are
          performed.  In this example, the package has a file-related
          verification problem:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv bash</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 279448
D: dependencies: looking for libc.so.5
D: dependencies: looking for libtermcap.so.2
missing    /etc/bashrc
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          When the <command>--nofiles</command> option is added, the missing
          file doesn't cause a message any more:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv --nofiles bash</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 279448
D: dependencies: looking for libc.so.5
D: dependencies: looking for libtermcap.so.2
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          This is not to say that the missing file problem is solved, just that
          no file verification was performed.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-v-option">
        <title><command>-v</command> &mdash; Display Additional
        Information</title> <!-- label: verify-v -->

        <indexterm>
          <primary><command>-v</command> option</primary>
        </indexterm>

        <para>
          Although RPM won't report an error with the command syntax if you
          include the <command>-v</command> option, you won't see much in the
          way of additional output:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vv bash</userinput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          Even if there are verification errors, adding <command>-v</command>
          won't change the output:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vv apmd</userinput>
<computeroutput>
S.5....T   /etc/rc.d/init.d/apm
S.5....T   /usr/X11R6/bin/xapm
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          The only time that the <command>-v</command> option
          <emphasis>will</emphasis> produce output is when the package being
          verified has a verification script.  Any normal output from the script
          won't be displayed by RPM, when run without <command>-v</command>:
          <footnote>
            <para>
              Failure messages will always be displayed.
            </para>
          </footnote>

          <screen width="60">
<prompt># </prompt><userinput>rpm -V bother</userinput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          But when <command>-v</command> is added, the script's
          non-error-related output is displayed:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vv bother</userinput>
<computeroutput>
This is the bother 3.5 verification script
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          If you're looking for more insight into RPM's inner workings, you'll
          have to try the next option:
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-vv-option">
        <title><command>-vv</command> &mdash; Display Debugging
        Information</title> <!-- label: verify-vv -->

        <indexterm>
          <primary><command>-vv</command> option</primary>
        </indexterm>

        <para>
          Sometimes it's necessary to have even <emphasis>more</emphasis>
          information than we can get with <command>-v</command>.  By adding
          another <command>v</command>, that's just what we'll get:

          <screen width="60">
<prompt># </prompt><userinput>rpm -Vvv rpm</userinput>
<computeroutput>
D: opening database in //var/lib/rpm/
D: verifying record number 2341208
D: dependencies: looking for libz.so.1
D: dependencies: looking for libdb.so.2
D: dependencies: looking for libc.so.5
</computeroutput>
<prompt>#</prompt>
          </screen>
        </para>

        <para>
          The lines starting with <computeroutput>D:</computeroutput> have been
          added by using <command>-vv</command>.  We can see where the RPM
          database is located and what record number contains information on the
          <filename>rpm-2.3-1</filename> package.  Following that is the list of
          dependencies that the <filename>rpm</filename> package requires.
        </para>

        <para>
          In the vast majority of cases, it will not be necessary to use
          <command>-vv</command>.  It is normally used by software engineers
          working on RPM itself, and the output can change without notice.
          However, it's a handy way to gain insights into RPM.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-dbpath-option">
        <title>
          <command>--dbpath <replaceable>&lt;path&gt;</replaceable></command>:
          Use <command><replaceable>&lt;path&gt;</replaceable></command> To Find
          RPM Database
        </title>
        <!-- label: verify- -dbpath -->

        <indexterm>
          <primary><command>--dbpath</command> option</primary>
        </indexterm>

        <para>
          In order for RPM to do its handiwork, it needs access to an RPM
          database.  Normally, this database exists in the directory specified
          by the <filename>rpmrc</filename> file entry,
          <command>dbpath</command>.  By default, <command>dbpath</command> is
          set to <filename>/var/lib/rpm</filename>.
        </para>

        <para>
          Although the <command>dbpath</command> entry can be modified in the
          appropriate <filename>rpmrc</filename> file, the
          <command>--dbpath</command> option is probably a better choice when
          the database path needs to be changed temporarily.  An example of a
          time the <command>--dbpath</command> option would come in handy is
          when it's necessary to examine an RPM database copied from another
          system.  Granted, it's not a common occurrence, but it's difficult to
          handle any other way.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-root-option">
        <title>
          <command>--root <replaceable>&lt;path&gt;</replaceable></command>: Set
          Alternate Root to
          <command><replaceable>&lt;path&gt;</replaceable></command>
        </title>
        <!-- label: verify- -root -->

        <indexterm>
          <primary><command>--root</command> option</primary>
        </indexterm>

        <para>
          Adding <command>--root
          <replaceable>&lt;path&gt;</replaceable></command> to a verify command
          forces RPM to assume that the directory specified by
          <command><replaceable>&lt;path&gt;</replaceable></command> is actually
          the "root" directory.  In addition, RPM expects its database to reside
          in the directory specified by the <command>dbpath</command>
          <filename>rpmrc</filename> file entry, relative to
          <command><replaceable>&lt;path&gt;</replaceable></command>.
          <footnote>
            <para>
              For more information on <filename>rpmrc</filename> file entries,
              see <xref linkend="ch-rpmrc-file">.
            </para>
          </footnote>
        </para>

        <para>
          Normally this option is only used during an initial system install, or
          when a system has been booted off a "rescue disk", and some packages
          need to be re-installed in order to restore normal operation.
        </para>
      </sect2>

      <sect2 id="s2-rpm-verify-rcfile-option">
        <title>
          <command>--rcfile <replaceable>&lt;rcfile&gt;</replaceable></command>:
          Set Alternate <filename>rpmrc</filename> file to
          <command><replaceable>&lt;rcfile&gt;</replaceable></command>
        </title>
        <!-- label: verify- -rcfile -->

        <indexterm>
          <primary><command>--rcfile</command> option</primary>
        </indexterm>

        <para>
          The <command>--rcfile</command> option is used to specify a file
          containing default settings for RPM.  Normally, this option is not
          needed.  By default, RPM uses <filename>/etc/rpmrc</filename> and a
          file named <filename>.rpmrc</filename>, located in your login
          directory.
        </para>

        <para>
          This option would be used if there was a need to switch between
          several sets of RPM options.  Software developer and package builders
          will be the people using <command>--rcfile</command>.  For more
          information on <filename>rpmrc</filename> files, see <xref
          linkend="ch-rpmrc-file">.
        </para>
      </sect2>
    </sect1>

    <sect1 id="s1-rpm-verify-we-lied">
      <title>We've Lied to You&hellip;</title>

      <indexterm>
        <primary><command>rpm -V</command></primary>
        <secondary>verification, control of</secondary>
      </indexterm>

      <para>
        Not really; we just omitted a few details until you've had a chance to
        see <command>rpm -V</command> in action.  Here are the details:
      </para>

      <sect2 id="s2-rpm-verify-verification-control">
        <title>RPM Controls What Gets Verified</title>

        <para>
          Depending on the type of file being verified, RPM will not verify
          every possible attribute.  Here is a table showing the attributes
          checked for each of the different file types:

          <table id="tb-rpm-verify-verification-control">
            <title>Verification Versus File Types</title>
            <tgroup cols="10">
              <tbody>
                <row>
                  <entry>
                    File Type
                  </entry>
                  <entry>
                    File Size
                  </entry>
                  <entry>
                    Mode
                  </entry>
                  <entry>
                    MD5 Checksum
                  </entry>
                  <entry>
                    Major Number
                  </entry>
                  <entry>
                    Minor Number
                  </entry>
                  <entry>
                    Symlink String
                  </entry>
                  <entry>
                    Owner
                  </entry>
                  <entry>
                    Group
                  </entry>
                  <entry>
                    Modification Time
                  </entry>
                </row>

                <row>
                  <entry>
                    Directory File
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                </row>

                <row>
                  <entry>
                    Symbolic Links
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                </row>

                <row>
                  <entry>
                    FIFO
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                </row>

                <row>
                  <entry>
                    Devices
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                </row>

                <row>
                  <entry>
                    Regular Files
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    -
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                  <entry>
                    X
                  </entry>
                </row>
              </tbody>
            </tgroup>
          </table>
        </para>

        <sect3 id="s3-rpm-verify-package-builder-control">
          <title>The Package Builder Can Also Control What Gets Verified</title>

          <para>
            When a package builder creates a new package, they can control what
            attributes are to be verified on a file-by-file basis.  The reasons
            for excluding specific attributes from verification can be quite
            involved, but here's an example just to give you the flavor:
          </para>

          <para>
            When a person logs into a system, there are device files associated
            with that user's terminal session.  In order for the terminal device
            (called <filename>tty</filename>) to function properly, the owner
            and group of the device must change to that of the person logging
            in.  Therefore, if RPM were to verify the package that created the
            <filename>tty</filename> device files, any ttys that were in use at
            the time would fail to verify.  However, by using the
            <command>%verify</command>
            <footnote>
              <para>
                See <xref linkend="s3-rpm-inside-flist-verify-directive"> for
                details on <command>%verify</command>
              </para>
            </footnote>
            directive, a package builder can save you from trivial
            verification failures.
          </para>
        </sect3>
      </sect2>
    </sect1>
  </chapter>
@


1.1.1.1
log
@Import book 'Maximum RPM' by Ed Bailey, version 1.0
@
text
@@