Inspecting and extracting RPM package contents

This article will cover basics of the RPM package architecture and show how we can see RPM package content and extract it. There will be examples how to extract RPM package files from Linux command line.

An RPM package is simply a header structure on top of a CPIO archive. The package itself is comprised of four sections: a header with a leading identifier (magic number) that identifies the file as an RPM package, a signature to verify the integrity of the package, the header or ‘tagged’ data containing package information, version numbers, and copyright messaging, and the archive containing the actual program files.

List files in an RPM package file using the rpm command

The RPM package manager rpm comes with various utilities to interact with packages. The following command will list all the files inside an RPM package:

For example:

In this example, the rpm command is used with the flag -q to specify it as a query command, -l to list the files in the package, and -p so it knows to query the uninstalled package file. The -v flag (verbose) just provides additional information (permissions, owner, etc.) for the sake of this example. As we can see, the package installs an executable binary called packagecloud_hello into /usr/local/bin/.

List files in an installed RPM package

Use the rpm command with -q and -l flags to list the files from an installed RPM package:

NOTE the use of a package’s name in the previous command and not the path to a specific RPM package.

Extract cpio archive from RPM packages

To extract files from an RPM package you must first extract a cpio archive from the package itself. RedHat provides a utility called rpm2cpio which does exactly that:

Extract files from an RPM package’s cpio archive

The rpm2cpio command will output (to stdout) a cpio archive from the RPM package. To extract the package files we’ll use the output from rpm2cpio and then use the cpio command to extract and create the files we need.

For example:

The cpio command copies files to and from archives. In the example above, we use cpio with the -i flag to extract the files from the archive, -d to create the leading directories where needed, and -m to preserve the file modification times when creating files. The -v flag (verbose) is to list the files processed for the sake of this example.

The result of our previous example is the creation of a ./usr/ folder in our working directory containing the files from the RPM package packagecloud-test-1.1-1.x86_64.rpm.

NOTE that simply extracting package files to the root directory does NOT properly install a package. Use the yum or rpm tools to correctly install RPM packages.

Show RPM package preinstall and postinstall scripts

To show the scripts that will run when a package is installed or uninstalled from a system, use the --scripts flag when querying a package using rpm. The following command will show the scripts for an uninstalled package test-1.1-1.el6.x86_64.rpm:

This will output something like:

To view the scriptlets of an already installed package, you can use the following syntax when using rpm

View contents of RPM packages on remote repositories using repoquery

repoquery is provided by the yum-utils package, make sure it’s installed:

The repoquery command is used to query information from Yum repositories installed on the system. By default, the repoquery command will download the Yum repo metadata and update the cache. To run repoquery entirely from the Yum cache, use the -C or --cache flag. To list the contents of a package, pass the --list flag to the repoquery command:

For example:

This can be useful when viewing the contents of packages that aren’t downloaded or installed on your the system. repoquery will only provide information on packages avaliable in the configured Yum repositories.

Understanding how packages interact with the systems they’re installed on can be helpful in day-to-day operations. By knowing that the RPM package is comprised of a cpio archive and header data, we can extract the information needed with already existing tools (rpm2cpio and cpio) and use the RPM toolchain to query, inspect, and view the contents of an RPM package.