Querying RPM Packages for Content

If you’ve ever used RPM from the command line, you know about the -i (install) and -U (upgrade) options, but you may not be familiar with RPM’s query features. When you run a query against an RPM database, you have to tell rpm which database you want to view. If you want to peek inside a package file (typically a file whose name ends in .rpm), include --package filename on the command line (or -p filename for short); otherwise, rpm will display information from the master database of packages that you’ve already installed.

Table 16-1 shows some of the most useful rpm query options. To use each of the commands, just open a terminal window and type in the command — no special privileges are required.

You can run each of the commands shown in Table 16-1 against multiple packages (or package files) at once. Just list the names that you’re interested in at the end of the command like this:

$ rpm -q kdebase gnome-desktop kdebase-3.1.4.2 ghome-desktop-2.4.0-1

TABLE 16-1: SOME HANDY RPM QUERY OPTIONS

When you view a package’s digest, rpm tells you which group the package belongs to, for example:

$ rpm -qi kdebase

The kdebase package is part of the group User Interface/Desktops. You can use the group name to select the packages that you’re interested in. To find all the games installed on your system (or at least those games installed with RPM), use this command:

$ rpm -qg “Amusements/Games” tuxracer-0.61-23 chromium-0.9.12-24

To display a list of all the RPM group names on your system, type in the following command:

$ rpm -qa --qf “%{GROUP}\n” | sort -u

In addition to the queries shown in Table 16-1, here are a few combinations that we find particularly handy:

rpm -qf filename

This query displays the name of the package that owns the given file. Use this query when you run into a file and you don’t know where it came from. You have to include the complete pathname of the file that you’re interested in, not just the filename.

rpm -qa --last | head -n 10

This query displays the names (and install dates) of the ten most-recently-installed packages.

rpm -qa | grep -i name

Use this query to locate an installed package when you don’t know the exact spelling of the package name. (The -i option tells grep to do a case-insensitive search.)

Digesting Information

Every RPM package includes a digest. Here’s a rundown of the information included in a typical digest (not all packages include every item that we list here):

Package name: A package whose name includes devel is meant for developers. A package whose name starts with lib doesn’t do anything all by itself; it adds features to other packages. libpackages are typically prerequisites for other packages.

Version number

RPM build date

Author or vendor’s name

Project Web site: The project Web site is a great place to look for more documentation, add-ons, and ways to commune with other users.

Product license type

Product description

Name of the source RPM: Most packages are built from a source RPM. The source RPM contains the source code for the package.

RPM size

Some open-source software packages are distributed for noncommercial use only. Check the information digest to be sure that you’re not violating the license.

Creating a Package Index

When you download a distribution from the Web site, you typically download a set of disc images. The standard Fedora distribution takes four CDs (unless you want the source code, too — in which case, it takes eight). The Fedora distribution contains lots of files . . . 300,682 according to our latest distribution. What if you need to know which disk just two or three of them are on?

Fortunately, Linux makes that information readily available and easy to store. With just a few easy steps, you can create a complete catalog that contains a list of the CD contents. After you make the index, you can open it with a text editor (like Kate) and search for what you need.

Creating (and saving) a package index will save you time whenever you need to install a new package: You won’t have to search through all the CDs for the one you need.

To create a package index for the Fedora distribution, follow these steps:

1. Open a terminal window and give yourself superuser privileges:

$ su Password:

$

2. Insert and mount the first install disc:

3. Move to the RPMS directory:

#cd /mnt/cdrom/Fedora/RPMS

4.Enter the following command:

#for name in*.rpm

This command starts a for loop: The bash shell executes each command in the loop a number of times. The variable $name holds the name of the next package file each time through the loop. When you press Enter, the shell displays a different prompt to tell you that you’re in the middle of a complex command.

5. Next to the new prompt, enter the next line of code and press Enter:

>do

6.On the next line, enter this command:

>rpm -qpi $name >> ~/DiscOne

This command displays the digest from the package file ($name) and appends the output to the file ~/DiscOne.

7. Then enter this:

> rpm -qpl $name >> ~/DiscOne

This appends the name of each file in the package to the end of ~/DiscOne.

8. Enter done and press Enter.

If you have more than one install disc, repeat this sequence for each disc (but change the name of the output file to ~/DiscTwo, ~/DiscThree, and so on).

The procedure to create a package index is similar for the SuSE or Mandrake Linux distributions. Just substitute the appropriate file and directory names.

This sequence of commands takes a while to complete, but when it’s done, you have a file in your home directory that you can use over and over. To find the files you need, just open the package list with the editor of your choice, and search.

Querying for Prerequisites

Before installing an RPM package, it’s handy to know what other packages you’ll need to install at the same time. The prerequisites can vary from needing a specific version of the Linux kernel, to needing some pretty exotic libraries.

To save yourself time and grief, query your RPM package for its dependencies before you install it. If you need a library file that hasn’t been seen in recent history, or 20 or 30 other obscure files, it might be quicker to find a piece of software that’s not so needy.

To query an RPM package for its dependencies, use the following command:

$ rpm -qpR name.rpm

Run the command on Webmin, and the result looks something like this:

$ rpm -qpR webmin-1.121-1.noarch.rpm /bin/sh

/usr/bin/perl

You can see that Webmin needs a bash shell and perl to install and run properly. These are easy requirements — you can find these two common packages on most distribution discs!

Don’t Put That in Your Drive;

You Don’t Know Where

That’s Been!

Everywhere on the Web you see them . . . RPMs just waiting to be grabbed. But how do you know what’s in them? Should you really be downloading things to your safe and secure system without at least looking at them first?

You can use rpm with a remote FTP site to query for the contents of a remote package. After you see the contents, you can decide if it’s something worth bringing home.

Just remember, if someone really wants to be malicious and change filenames and mask creation information, he or she can. chroot jails can be a big help in isolating programs you want to try but don’t trust completely (see Technique 58 for more information).

Usually, downloads from the Web come from an FTP or HTTP server. To perform a remote query on an FTP server, use this command:

$ rpm -ql ftp://ftp.example.com/path.rpm

To perform a remote query on an HTTP server, enter the following command:

$ rpm -ql http://www.example.com/path.rpm

These queries are straightforward. If you need to, you can include user names and passwords, just like you would in a normal URL. See Technique 14 for more information about downloading from Web servers or FTP servers.

In Technique 18, we show you how to verify a package’s digital signature before you install it. We also show you to find out whether the files installed

by a given package have been changed since you installed them — a great way to watch for tampering fingers wandering around on your computer.