brendan kehoe wrote as a workaround the various distributions could use a gpg singature to verify correctness of the file since the distributor s secret key is required to create that signature it would add a pretty significant step that would have to be taken to make it possible to replace both a rpm or apt file and its accompanying signature check your local friendly red hat installation root localhost upNUMBERdate rpm checksig zsh NUMBER NUMBER NUMBER NUMBER src rpm zsh NUMBER NUMBER NUMBER NUMBER src rpm mdNUMBER gpg ok of course this is only as useful as say the gpg keys distributed with the kernel tarballs i e if you don t actually bother checking the sig then you are open to abuse it s entirely possible that rpm can be configured to require good signatures but i ve not read that part of the fine manual just yet cheers waider waider URL yes it is very personal of me irish linux users group ilug URL URL for un subscription information list maintainer listmaster URL 