RPM Package Manager

RPM Package Manager
™/®Red Hat, Inc. · Public domain · source
Name	RPM Package Manager
Developer	Red Hat, Fedora Project, openSUSE Project, SUSE
Released	1997
Latest release version	varies by distribution
Programming language	C, Shell
Operating system	Linux
License	GNU General Public License

RPM Package Manager

RPM Package Manager is a powerful package management system originally developed for Red Hat Linux and later adopted by multiple Fedora Project and openSUSE Project distributions. It provides a binary package format, a database of installed files, and tools for installing, querying, verifying, and uninstalling software on Linux distributions derived from Red Hat Enterprise Linux and SUSE Linux Enterprise. RPM has influenced package systems across Unix-like operating systems and is central to many enterprise and community projects.

History

RPM development began at Red Hat, Inc. in the mid-1990s to standardize software distribution for Red Hat Linux and to compete with package technologies used by projects such as Debian and commercial vendors like Caldera, Inc.. Early RPM work intersected with efforts by Earl T. Washington and contributors from companies like Cygnus Solutions, and the project evolved alongside initiatives such as Fedora Project and the growth of Linux kernel development. As RPM matured it became core infrastructure for Red Hat Enterprise Linux and influenced packaging approaches used by SUSE, Mandriva, and community distributions. Over time, stewardship involved collaborative governance among groups including the Open Source Initiative-aligned communities and corporate stewards at SUSE and Red Hat, Inc..

Design and Architecture

RPM's architecture centers on a package database and modular tools implemented in C (programming language) and shell utilities. The system uses a metadata-driven model for file lists, dependency tags, and scripts, enabling transactional operations similar to approaches found in dpkg ecosystems. RPM packages contain headers with tags derived from standards used in POSIX environments and can incorporate pre-install and post-install scriptlets that execute during lifecycle events, a design decision shared with packaging tools from Solaris and AIX. The modular command-line frontend integrates with higher-level helpers such as YUM and DNF, which manage dependency resolution and repositories, while lower-level libraries expose APIs used by configuration management systems like Ansible, Puppet, and Chef.

Package Format and File Types

An RPM package is an archive combining a lead, header, signature, and payload, typically using compression formats like gzip, bzip2, and xz; the payload often uses the cpio archive format. Metadata includes tags for versioning, architecture, provides/requires relationships, changelogs, and licensing information. Files within packages may include binaries, libraries, documentation, configuration files, and scripts; special flags mark configuration files and triggers. The format supports RPM Signature verification using cryptographic schemes tied to OpenPGP/GnuPG keys and integrates with system verification tools present in distributions such as CentOS, AlmaLinux, and Oracle Linux.

Commands and Usage

Core RPM commands provide install, query, verify, and removal operations and are commonly invoked via the rpm binary with subcommands like -i, -U, -q, -e, and --verify. Administrators use query formats to extract metadata fields compatible with integration into tools such as systemd unit generation, package auditing with OpenSCAP, and reporting to management planes like Red Hat Satellite. Higher-level utilities such as YUM, DNF, and graphical package managers in KDE and GNOME desktops wrap rpm and provide repository management, delta RPM support from services like presto, and automatic updates coordinated with update frameworks in enterprise systems like Spacewalk and Uyuni.

Development and Ecosystem

RPM development is maintained by contributors from corporate projects including Red Hat, Inc. and SUSE, community projects like Fedora Project and openSUSE Project, and independent maintainers. The ecosystem includes tools for building packages such as rpmbuild, spec file standards, build systems like Koji, continuous integration services used by CentOS Stream and corporate build farms, and buildroot-like technologies employed in Yocto Project-based workflows. Packaging guidelines and macros are shared across projects including Fedora Packaging Guidelines and openSUSE Packaging practices, and integration exists with source control platforms such as Git and forge services like Pagure and GitLab.

Security and Verification

RPM supports cryptographic signing using OpenPGP-compatible keys managed by GnuPG and key distribution mechanisms in distribution repositories run by organizations like Red Hat, Inc. and SUSE. Verification features include file-level checksums, package signature validation, and rpm --verify comparisons that detect alteration of binaries, libraries, and configuration files. Security tooling integrates RPM with vulnerability databases maintained by entities such as CVE (Common Vulnerabilities and Exposures), advisory systems like Red Hat Security Data API, and scanning frameworks including OpenSCAP and Clair, enabling patch management policies enforced by solutions like Red Hat Satellite and corporate compliance programs in sectors overseen by regulators such as NIST.

Adoption and Distributions

RPM is the native package format for distributions including Red Hat Enterprise Linux, Fedora Project, CentOS, openSUSE Project, SUSE Linux Enterprise, Oracle Linux, AlmaLinux, and Rocky Linux. It is also used in specialized builds for projects like Clear Linux components, embedded systems via Yocto Project-derived images, and appliance distributions curated by companies such as IBM and Microsoft for Linux-based offerings. Cross-project tooling and migration utilities exist to translate packages between RPM and other formats employed by Debian-based systems and container ecosystems driven by Docker and Podman.

Category:Software