RPM 6.1.0 was released on August 21, and it is a more substantial update than the version number implies. It will be the default package manager in upcoming Red Hat Enterprise Linux releases and derivatives, including Fedora 45.

A 26% speedup from closing files better

RPM now closes file descriptors more efficiently on Linux 5.11 or newer with glibc 2.34 or later, cutting installation time by around 26% in some cases.

This is a satisfying kind of optimization. Installing a package means opening and closing an enormous number of files, and the traditional approach to cleaning up descriptors involved iterating over a large range of possible values whether or not they were in use. Newer kernels provide a mechanism to do this properly, and RPM now uses it.

Nothing about package contents changed. The same work simply stopped wasting time on bookkeeping.

PKCS#11 signing

rpmsign can now sign packages using PKCS#11 tokens, meaning hardware security modules and smart cards.

For anyone maintaining a package repository, this is the difference between a signing key sitting in a file on a build machine and a key that physically cannot be exfiltrated. Given this week’s Rust supply-chain attack, where the likely cause was stolen publishing credentials, moving signing keys into hardware is not an abstract improvement.

rpmkeys also had its exit code fixed so it no longer wraps around and incorrectly reports success on failure, which is exactly the kind of bug that silently defeats a verification script.

The 6.0 regression is fixed

The keystore now uses its own lock rather than sharing the transaction lock. This fixes a regression in RPM 6.0 where all RPM database queries were blocked for the duration of any transaction.

If you have ever had a monitoring check or a script hang because an update was running, this was likely why.

Other changes

• NSS-based user and group lookups are restored by default, reversing a change made in RPM 4.19
• Macro behavior can be modified at definition time with new modifier syntax, initially offering literal expansion and one-shot expansion

The release model

RPM 6.1 adopts a release model inspired by the Linux kernel, with a predictable cadence rather than releases arriving when they arrive.

For a component this deep in the stack, predictability is worth a lot. Distribution maintainers can plan around a schedule; they cannot plan around “when it is ready.”