An RPM v4 package is the lead, the signature, the header and the payload, one after the other. All integers are big-endian. This page follows the RPM project’s format documents (“RPM v4 package format”, “Package lead”, “Header structure”). The tags themselves are on the header tags page.
Lead
96 bytes, kept for compatibility; the real information is in the header.
| Offset | Size | Field | Meaning |
|---|---|---|---|
0 | 4 | magic | ED AB EE DB. |
4 | 1 | major | Major format version (3 in the documentation’s example). |
5 | 1 | minor | Minor format version (0). |
6 | 2 | type | 0 = binary package, 1 = source package. |
8 | 2 | archnum | Architecture code from rpmrc (1 = i386); the real architecture is in the header. |
10 | 66 | name | Name-version-release, up to 65 characters, NUL-terminated and NUL-padded. |
76 | 2 | osnum | Operating system code (1 = Linux). |
78 | 2 | signature_type | 5: a header-structured signature follows. |
80 | 16 | reserved | Unused. |
Header structure
The signature and the header have the same structure: a 16-byte intro, an index of 16-byte entries sorted by tag, then the data.
| Offset | Size | Field | Meaning |
|---|---|---|---|
0 | 3 | magic | 8E AD E8. |
3 | 1 | version | 01. |
4 | 4 | reserved | Zero. |
8 | 4 | count | Number of index entries. |
12 | 4 | size | Length of the data section in bytes. |
16 | 16 × count | index | The entries (below). |
| … | size | data | The values. |
| Entry offset | Size | Field | Meaning |
|---|---|---|---|
0 | 4 | tag | Which value this is. |
4 | 4 | type | Data type (below). |
8 | 4 | offset | Signed offset of the value from the start of the data section. |
12 | 4 | count | Number of values (1 for STRING). |
Data types
| Type | Name | Item size and alignment |
|---|---|---|
| 1 | CHAR | 1 |
| 2 | INT8 | 1 |
| 3 | INT16 | 2, aligned to 2 |
| 4 | INT32 | 4, aligned to 4 |
| 5 | INT64 | 8, aligned to 8 |
| 6 | STRING | One NUL-terminated string; count must be 1 |
| 7 | BIN | count bytes of binary data |
| 8 | STRING_ARRAY | count NUL-terminated strings back to back |
| 9 | I18NSTRING | Translated strings (layout not described in the format document) |
Numbers are padded with zero bytes to their alignment within the data section; string lengths are found by looking for the terminating NUL.
Immutable regions
A region marks the original entries so they can be verified after the header has been
changed (for example by adding install-time tags). The first index entry has the
region tag (62 HEADERSIGNATURES in the signature, 63 HEADERIMMUTABLE in the header),
type BIN, count 16, and an offset pointing to a 16-byte trailer in the
data. The trailer is an index entry again: the same tag, type BIN, count 16, and a
negative offset whose size is the size of the region’s index entries, so the region
holds −offset ÷ 16 entries. In a header read from disk this should equal
the index count; tags added later fall outside it (“dribbles”).
Signature
A header structure, zero-padded to a multiple of 8 bytes, whose first tag is 62. Its tag numbers may overlap with header tags.
| Tag | Name | Note |
|---|---|---|
| 62 | HEADERSIGNATURES | Region tag, first. |
| 267 | DSA | |
| 268 | RSA | |
| 269 | SHA1 | |
| 270 | LONGSIZE | 64-bit form of SIZE. |
| 271 | LONGARCHIVESIZE | 64-bit. |
| 272 | SHA256 | rpm 4.14 and later. |
| 274 | FILESIGNATURES | |
| 276 | VERITYSIGNATURES | |
| 1000 | SIZE | |
| 1002 | PGP | |
| 1004 | MD5 | |
| 1005 | GPG | |
| 1008 | RESERVEDSPACE | Space reserved so that packages can be signed faster. |
Every package has HEADERSIGNATURES, SIZE or LONGSIZE, MD5 and SHA1.
Header
A header structure whose first tag is 63 (HEADERIMMUTABLE), holding the package’s metadata: name, version, dependencies, scripts and the file list. Every tag is on the header tags page.
Payload
A cpio archive in the SVR4 format with a CRC
checksum (see cpio headers), compressed
with gzip by default; the %_binary_payload and
%_source_payload macros choose others. The header’s PAYLOADFORMAT,
PAYLOADCOMPRESSOR and PAYLOADFLAGS tags record what was used. Since rpm 4.12, packages
with files of 4 GB or more use a stripped-down cpio form with magic
07070X, which stores only each file’s index into the header’s file list
as 8 hexadecimal digits, without the usual cpio metadata.
Sources
RPM documentation (rpm-software-management.github.io/rpm/manual): “RPM v4 package format”, “RPM package lead” and “RPM header structure”. That header page gives the region tags the other way round from the format page; this page follows the format page (62 for the signature, 63 for the header). What each signature tag holds is not described in these documents beyond its name.