CME-406

Signed Package Enforcement (GPG)

Harden OS/Kernel Unquantified evidence Preventive

Description

Rejects installation of unsigned or tampered RPM/DEB packages by validating GPG signatures against trusted keys. Prevents supply chain attacks via package repositories.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	Cannot install tampered packages; cryptographic verification enforced

CWE Relationships

CWE-345 CWE-494 CWE-347

Verification

Verify gpgcheck enabled for all repos

$ grep -r 'gpgcheck' /etc/yum.repos.d/ | grep -v 'gpgcheck=1'

Platform: rhel

$ rpm -qa gpg-pubkey
# Expected: gpg-pubkey

Platform: rhel

Remediation

rhel Enforce GPG signature verification on all dnf/yum repositories


sed -i 's/^gpgcheck=.*/gpgcheck=1/' /etc/dnf/dnf.conf || sed -i 's/^gpgcheck=.*/gpgcheck=1/' /etc/yum.conf
sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.repos.d/*.repo
printf '[main]\nrepo_gpgcheck=1\n' > /etc/dnf/plugins/repo_gpgcheck.conf 2>/dev/null; grep -qx 'repo_gpgcheck=1' /etc/dnf/dnf.conf || echo 'repo_gpgcheck=1' >> /etc/dnf/dnf.conf
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release 2>/dev/null; rpm -qa gpg-pubkey | grep -q gpg-pubkey