Starting with RealVNC Connect 8.5.0 and RealVNC Server and Classic Viewer 7.18.0, RealVNC signs its RPM packages with a GPG key so you can verify that a package was built by RealVNC and has not been tampered with since it was released. This article explains how to import the RealVNC signing key and use it to verify an RPM package before installing it.

Before you begin

You will need:

• The rpm utility (pre-installed on RPM-based distributions such as RHEL and Rocky Linux)
• The downloaded RealVNC Connect RPM package you want to verify

Import the RealVNC signing key

The RPM utility maintains its own keyring, separate from any personal GPG keyring. You must import the RealVNC public key into the RPM keyring before verification is possible.

1. Download the RealVNC public signing key:

   curl -O https://downloads.realvnc.com/download/file/realvnc-signing.asc

2. Import the key into the RPM keyring:

   sudo rpm --import realvnc-signing.asc

   No output is produced on success.

3. Confirm the key was imported by listing keys in the RPM database:

   rpm -qa gpg-pubkey* --qf "%{name}-%{version}-%{release} %{summary}\n"

   You should see an entry for RealVNC Limited in the output.

Verify the RPM package

1. Run the following command, replacing realvnc-package.rpm with the filename of your downloaded package:

   rpm -K realvnc-package.rpm

2. Check the output:
   • Successful verification: the output ends with digests signatures OK, confirming the package is authentic and unmodified.
   • Failed verification: the output contains SIGNATURES NOT OK or DIGESTS NOT OK. Do not install the package. Download it again from the RealVNC website and re-verify.

Removing the key

If you need to remove the RealVNC key from the RPM keyring (for example, to re-import an updated key), first identify the key package name:

rpm -qa gpg-pubkey* --qf "%{name}-%{version}-%{release} %{summary}\n"

Then remove it using the name shown in the output:

sudo rpm -e gpg-pubkey-XXXXXXXX-XXXXXXXX