\clearpage
\subsection{Package Signatures}
%\addcontentsline{toc}{section}{Appendix B - Package Signatures}

All of the RPMs provided via the \OHPC{} repository are signed with a GPG
signature. By default, the underlying package managers will verify these signatures during
installation to ensure that packages have not been altered. The RPMs can also
be manually verified and the public signing key fingerprint for the latest
repository is shown below: \\

\texttt{Fingerprint: 5E33 3CA3 A1BD BBC9 DF14 9D74 09AD FAE4 {\bf D722A692}} \\

\noindent The following command can be used to verify an RPM once it
has been downloaded locally by confirming if the package is signed, and if so,
indicating which key was used to sign it. The example below highlights usage
for a local copy of the \texttt{docs-ohpc} package and illustrates how the {\em
key ID} matches the fingerprint shown above.

\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) rpm --checksig -v ohpc-release-4-1.el10.x86_64.rpm
ohpc-release-4-1.el10.x86_64.rpm:
    Header V3 RSA/SHA256 Signature, key ID d722a692: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V3 RSA/SHA256 Signature, key ID d722a692: OK
    MD5 digest: OK

\end{lstlisting}
