Short Tip: Extract Files from a RPM file

shell.png
Sometimes it is necessary to extract a file from a RPM without actually installing it. This way you can extract for example binaries and check them for any malicious content before you install them to important system places. In case of src.rpms you can also directly extract a patch or spec in case you need it for your own RPM.

The tool you need in such a case is rpm2cpio. It converts an rpm file to a regular cpio archive.
In case you want to access a specific file you first have to list the entries of the file and afterwards extract them:

$ rpm2cpio coreutils-6.9-2.fc7.i386.rpm |cpio -t 
./bin/basename
./bin/cat
./bin/chgrp
./bin/chmod
[...]
$ rpm2cpio coreutils-6.9-2.fc7.i386.rpm |cpio -ivd ./bin/basename
./bin/basename
16525 blocks
$ ls
bin coreutils-6.9-2.fc7.i386.rpm

As you see the file is extracted together with the directory structure, in this case /bin/.

As a side note, you can of course also get the lsit of files in a package by rpm -qpl whatever.rpm.

Speaking about rpm: if I had a command and wanted to know which package delivers it I always issued rpm -q --whatprovides `which basename`, but today learned that rpm -qf `which basename` works just fine. You never stop learning.

11 thoughts on “Short Tip: Extract Files from a RPM file”

  1. would you know why rpm makes use of cpio instead of tar. I wonder because i thougth it was a legacy format

  2. It’s much easier to use mc (midnight commander) if you want to extract files from an RPM.

  3. I’ve noticed your posts always end up with names like “fedora.png” or “shell.png” on dot.kde.org. I know it teases the readers to click and find out what’s inside, but I’d prefer to know what the topic is. Thanks!

  4. mhb: This is an error in the Planet software which happens with all WordPress blogs. You can also check for example Andreas Pakulat’s posts.
    The Planet developers already published a fix, the planet admins just have to use it.

    In case you wanted to allege something: bugger off and check your facts first.

  5. I’m still awaiting for an automated way to convert a tar into
    an rpm, dep list is a really simple list (single layer) and there
    isn’t much more inside the rpm format…

  6. Oh, btw they choosed cpio instead of tar probably to have
    the ability to “mark” the document files, however it’s
    no more that useful actually (just put them in main dir
    plus a separate directory…)

  7. checkinstall was a way to generate a rpm on the fly. The problem is however that the quality of auto-generated packages isn’t really good.

Comments are closed.