drivers.suse.com usage

Package Signing Key

NOTE: Prior to November 12, 2013 the “SUSE SolidDriver Program” was known as the “Partner Linux Driver Program” (PLDP). Though the signing key still reflects the old name, it remains valid as described here.

Some of the packages and installation repositories hosted on drivers.suse.com are digitally signed with a package signing key. In order for SUSE installer to verify the authenticity and integrity of the packages or repositories the public key needs to be installed on the system.

Purpose

The purpose of the signing key is to enable users to validate the authenticity and integrity of the packages or repositories to be installed. The SolidDriver Signing key authenticates the following:

Package or repository was built in the official SUSE SolidDriver Program build service.
Packages are fully supported by SUSE and Partner company under the same terms of support delivered with SUSE Linux Enterprise server products.
The contents of the package has not been tampered or modified by a third party

Installation

SUSE recommends verifying all package signatures of all software before deploying on SUSE Linux Enterprise installations. The SUSE package installer (YaST or zypper) will do this automatically. The public key must be installed as trusted before the installer can verify packages signed with the key. If they key is not installed rpm will output the following warning when installing a package signed with this key:

warning: example.rpm: Header V3 RSA/SHA256 signature: NOKEY, key ID c2bea7e6

Also rpm --checksig will fail with the following output:

# rpm --checksig example.rpm
example.rpm: RSA sha1 (MD5) (PGP) md5 NOT OK (MISSING KEYS: PGP#c2bea7e6)

To avoid the installation warning, and to be able to verify packages signed with the SUSE SolidDriver key, Download the public key from here and install it using the following command:

# rpm --import gpg-pubkey-c2bea7e6-4c2de264.asc

The key can also be installed directly from the drivers.suse.com server:

# rpm --import http://drivers.suse.com/keys/gpg-pubkey-c2bea7e6-4c2de264.asc

After the key is imported, you can validate the packages by running the rpm --checksig command. A valid signed package would give the following:

# rpm --checksig pldp-example.rpm
pldp-example.rpm: rsa sha1 (md5) pgp md5 OK

Installing Driver Kits

Driver kits (driver installation repositories) hosted on drivers.suse.com may also be signed with this key When installing the driver kit on a system where this key was not previously installed, the following (or simlar) message will occur:

New repository or package signing key received:
Key ID: 79144284C2BEA7E6
Key Name: PLDP Signing Key 
Key Fingerprint: D59857D5CA0058DA627C5D7779144284C2BEA7E6

Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?](r):

In this case, the key’s fingerprint is displayed and can be used to validate the signature manually. Find the SUSE SolidDriver (PLDP) signing key fingerprint below.

Signing key fingerprint

pub   rsa2048/C2BEA7E6 2010-07-02 [expires: 2024-05-02]
      Key fingerprint = D598 57D5 CA00 58DA 627C  5D77 7914 4284 C2BE A7E6
uid       [ unknown]PLDP Signing Key <pldp@suse.de>

Public key

download public key