## Chapter 4. Importing Custom GPG Keys¶

For customers who plan to build and distribute their own RPMs securely, it is strongly recommended that all custom RPMs are signed using GNU Privacy Guard (GPG). Generating GPG keys and building GPG-signed packages are covered in the Channel Management Guide.

Once the packages are signed, the public key must be deployed on all systems importing these RPMs. This task has two steps: first, create a central location for the public key so that clients may retrieve it, and second, adding the key to the local GPG keyring for each system.

The first step is common and may be handled using the website approach recommended for deploying SUSE Manager client applications. (Refer to Section 2.1, “Deploying the Latest Client RPMs”.) To do this, create a public directory on the Web server and place the GPG public signature in it:

    cp /some/path/YOUR-RPM-GPG-KEY /srv/www/htdocs/pub/

The key can then be downloaded by client systems using Wget:

    wget -O- -q http://your_susemgr.your_domain.com/pub/YOUR-RPM-GPG-KEY

The `-O-` option sends results to standard output while the `-q` option sets Wget to run in quiet mode. Remember to replace the `YOUR-RPM-GPG-KEY` variable with the filename of your key.

Once the key is available on the client file system, import it into the local GPG keyring. Use the following command:

    rpm --import /path/to/YOUR-RPM-GPG-KEY

Once the GPG key has been successfully added to the client, the system should be able to validate custom RPMs signed with the corresponding key.