rpm

What it does

rpm (RPM Package Manager) works directly with .rpm package files: installing, querying, verifying, and removing them. It's the low-level engine underneath higher-level tools like yum and dnf, but unlike them, rpm does not reach out to any repository and does not resolve dependencies — it only acts on the exact package file (or installed package name) you give it. That makes it precise and fast for direct package inspection and installs from a local file, but it will simply refuse to install a package whose dependencies aren't already satisfied, which is exactly the gap yum/dnf exist to fill.

Beginner examples

• rpm -ivh package.rpm — install a package from a local file, showing progress hash marks (-h) and verbose output (-v)
• rpm -q nginx — check whether nginx is installed and print its version if so
• rpm -qa — list every package currently installed on the system
• rpm -e nginx — uninstall (erase) the nginx package

rpm -ivh ./custom-tool-2.1.0.rpm

Advanced examples

• Show detailed metadata about an installed package: rpm -qi nginx
• Find out which package owns a specific file on disk: rpm -qf /etc/nginx/nginx.conf
• List the files a package installed: rpm -ql nginx
• Verify an installed package's files haven't been modified since install: rpm -V nginx
• Upgrade to a newer version of a package from a local file, even if none is currently installed: rpm -Uvh nginx-1.25.0.rpm

rpm -qa | grep -i openssl

Common mistakes

• Running rpm -i package.rpm on a package with unmet dependencies and getting a "Failed dependencies" error, then trying to manually chase down every dependency by hand instead of using yum/dnf install ./package.rpm, which resolves them automatically.
• Confusing -i (install) with -U (upgrade) — -U installs even if no prior version exists, while plain -i will refuse to "upgrade" over an existing installation of the same package.
• Forgetting -qa requires the -q (query) mode — running rpm -a alone is not a valid combination and does nothing useful.
• Expecting rpm -e to remove dependent packages automatically — it only removes the named package and errors out if something else still depends on it.

Tips

• Combine rpm -qa with grep to quickly check whether something specific is installed, e.g. rpm -qa | grep -i python3.
• rpm -qf /path/to/file is a fast way to identify what installed a mysterious binary or config file when investigating an unfamiliar system.
• Use rpm -qpi package.rpm (note the extra p for "package file") to inspect metadata of an .rpm file before installing it.

Best practices

• Prefer yum/dnf install ./file.rpm over raw rpm -i for anything with dependencies, since it resolves them automatically instead of failing outright.
• Use rpm -V periodically (or as part of a security audit) to detect unexpected changes to files belonging to installed packages.
• Keep a habit of checking rpm -qi before removing an unfamiliar package, to understand what it provides and whether anything depends on it.

Real-world use cases

• Installing a vendor-provided or custom-built .rpm that isn't available in any configured repository.
• Auditing a server for installed package versions during a vulnerability review, e.g. rpm -q openssl.
• Tracing an unexpected file or binary back to the package that installed it during incident investigation.

Common interview questions

• What's the key difference between rpm and yum/dnf? rpm installs/queries exact package files without resolving dependencies; yum/dnf add repository management and automatic dependency resolution on top of the same underlying RPM package format.
• How would you install an RPM file that has unmet dependencies? Use yum install ./file.rpm or dnf install ./file.rpm instead of raw rpm -i, since those tools will fetch and install the missing dependencies from configured repositories.
• How do you find out which installed package a specific file belongs to? rpm -qf /path/to/file.