The deliveries of openSUSE are signed cryptographically.

The RPM and repositories are signed by GPG Keys. The openSUSE Containers are signed by both X.509 (PEM format) key (Notary and Sigstore/Cosign), and GPG format (Atomic method).

The keys can be found in the openSUSE-build-key package on the media and are trusted by default during installation.

Following keys are in use:

openSUSE project signing key 4096 bit RSA

This key is used starting with openSUSE Leap 15.5, and in openSUSE Tumbleweed and other openSUSE products from begin of 2023.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.15 (GNU/Linux)

mQINBGKwfiIBEADe9bKROWax5CI83KUly/ZRDtiCbiSnvWfBK1deAttV+qLTZ006
090eQCOlMtcjhNe641Ahi/SwMsBLNMNich7/ddgNDJ99H8Oen6mBze00Z0Nlg2HZ
VZibSFRYvg+tdivu83a1A1Z5U10Fovwc2awCVWs3i6/XrpXiKZP5/Pi3RV2K7VcG
rt+TUQ3ygiCh1FhKnBfIGS+UMhHwdLUAQ5cB+7eAgba5kSvlWKRymLzgAPVkB/NJ
uqjz+yPZ9LtJZXHYrjq9yaEy0J80Mn9uTmVggZqdTPWx5CnIWv7Y3fnWbkL/uhTR
uDmNfy7a0ULB3qjJXMAnjLE/Oi14UE28XfMtlEmEEeYhtlPlH7hvFDgirRHN6kss
BvOpT+UikqFhJ+IsarAqnnrEbD2nO7Jnt6wnYf9QWPnl93h2e0/qi4JqT9zw93zs
fDENY/yhTuqqvgN6dqaD2ABBNeQENII+VpqjzmnEl8TePPCOb+pELQ7uk6j4D0j7
slQjdns/wUHg8bGE3uMFcZFkokPv6Cw6Aby1ijqBe+qYB9ay7nki44OoOsJvirxv
p00MRgsm+C8he+B8QDZNBWYiPkhHZBFi5GQSUY04FimR2BpudV9rJqbKP0UezEpc
m3tmqLuIc9YCxqMt40tbQOUVSrtFcYlltJ/yTVxu3plUpwtJGQavCJM7RQARAQAB
tDRvcGVuU1VTRSBQcm9qZWN0IFNpZ25pbmcgS2V5IDxvcGVuc3VzZUBvcGVuc3Vz
ZS5vcmc+iQI+BBMBAgAoBQJisH4iAhsDBQkHhM4ABgsJCAcDAgYVCAIJCgsEFgID
AQIeAQIXgAAKCRA1ovhuKbcApKRrEACJMhZhsPJBOkYmANvH5mqlk27brA3IZoM4
8qTzERebzKa0ZH1fgRI/3DhrfBYL0M5XOb3+26Ize0pujyJQs61Nlo1ibtQqCoyu
dvP/pmY1/Vr374wlMFBuCfAjdad4YXkbe7q7GGjo6cF89qtBfTqEtaRrfDgtPLx/
s9/WXLGo0XYqCCSPVoU66jQYNcCt3pH+hqytvntXJDhU+DveOnQCOSBBHhCMST3E
QvriN/GnHf+sO19UmPpyHH0TM5Ru4vDrgzKYKT/CzbllfaJSk9cEuTY8Sv1sP/7B
Z7YvOE0soIgM1sVg0u3R/2ROx0MKoLcq7EtLw64eE+wnw9bHYZQNmS+J/18p7Bo8
I7e+8WRi+m/pus5FEWsIH1uhxKLgJGFDTHHGZtW+myjnUzXVIkpJGrKoolzYjHdK
lRYM2fVuNI1eq6CZ6PFXg2UxovVczSnGMO33HZE09vpgkRDBrw1vF0o/Wnm02kig
V6xYHk5wJx8vL74wPvCbw73UNT9OSdxYAz7JPqGOD6cpKe7XcAH2sYmlGpggAIUz
Rq/lROEF5lx4SxB838JU4ezxD++BJXfBTE8JZmlGscXv74y9nCtSOZza8KOKj8ou
WRl739FMnx9jRd7HHj3TIyymoveODnZ7f3IElyyFsjBW3XuQ9XfpZrIkwHuaZV5M
6q2h+hgWNQ==
=nMh8
-----END PGP PUBLIC KEY BLOCK-----

zypper import will show this finger print:

  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 04:03:14 PM CEST
  Key Expires:      Fri 19 Jun 2026 04:03:14 PM CEST
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22

This key is also in the "openSUSE-build-key" package in /usr/lib/rpm/gnupg/keys/gpg-pubkey-29b700a4-62b07e22.asc

openSUSE Backports project signing key 4096 bit RSA

This key is used starting with openSUSE Leap 15.5.

zypper import will show this fingerprint:

  Key Fingerprint:  F044 C2C5 07A1 262B 538A AADD 8A49 EB03 25DB 7AE0
  Key Name:         openSUSE:Backports OBS Project <openSUSE:Backports@build.opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Wed 10 May 2023 04:46:12 PM CEST
  Key Expires:      Sun 09 May 2027 04:46:12 PM CEST
  Rpm Name:         gpg-pubkey-25db7ae0-645bae34

This key can be found on openSUSE Leap 15.5 and newer in /usr/lib/rpm/gnupg/keys/gpg-pubkey-25db7ae0-645bae34.asc.

openSUSE Container signing key 4096 bit RSA

Use for containers from https://registry.opensuse.org/ starting mid 2023, in PEM format.

Use for containers from https://registry.opensuse.org/ starting mid 2023, in GPG format.

openSUSE Leap SLE imports signing key

The openSUSE Leap 15.x SLE import signing key is the 2048 bit RSA key, and can be found on https://www.suse.com/support/security/keys/

Note that it will soon switch over to a 4096 bit RSA key, also found on above page.

openSUSE Container signing key 2048 bit RSA

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.15 (GNU/Linux)

mQENBFrjEWoBCADEJttox1LVpcP2YIsLIO5qKmwfMhyjSQ+L4ETztnFRLKFIlin4
19Tic/llF9ymQr2MxlKlRgdzFZ9ScH1rg52bmWdxy+2TZ8JIsSV4XyfSTZJvM+nX
YGxEQBJrYlcRfC5he0tBGTEwG+hp6kXH563F+XU4uzGUmh1rBhavDsWjeMo9sjaf
sqn66JAJnxJrQOcqjNvazYjppEjFzye/Haqu2r5cnD/bPnMvQEZtpN1jznWkIha2
DdapVZq2b/SmdTMV7zHRqQvhERU2uS4SFLNopyt/cwujj3XTWqCArvQgRTaiHAiL
4HY3lUpDWH9pmxT+yu5f7FINc+prRmvnQ1YpABEBAAG0PW9wZW5TVVNFIENvbnRh
aW5lciBTaWduaW5nIEtleSA8YnVpbGQtY29udGFpbmVyQG9wZW5zdXNlLm9yZz6J
AT4EEwECACgFAlrjEWoCGwMFCRLMAwAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheA
AAoJENdUaU+atIzpdt0H/A5j9B7feqTRK49TWIsgKTELG+6ac4WL+uvZs4HmUPgO
Me9fkQvmJtPMGQT3awCSejEHuvq7sMsOOAXJ3loVDNkJWOtkohRyJf6++lvzL24v
ApbzSLfxa1intscyoJ0g8A2V+NzG428cMAzL5Rnf1ckimDkwOgjFBTDqwq1nPFDQ
+01wAenDPLduLAS65+urmMEOIhoBB3Opc5fqPKWU+w8qav8YfYUjaQcAfGeswt+6
m54VXYk8prmCuSfFHq9Yi8T2+VMcIEdHQYOn4nVhzNY9mTzJ4CCGYdLhap4/P8/x
HuiUuVrARHeCoTiQSc1FwjT1QXaU+yYk1SLFi0LaPgQ=
=Klfs
-----END PGP PUBLIC KEY BLOCK-----

Use for containers from https://registry.opensuse.org/, in GPG format.

old openSUSE project signing key 2048 bit RSA

This key was used up to openSUSE Leap 15.4, and in openSUSE Tumbleweed and related products up to begin of 2023.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.15 (GNU/Linux)

mQENBEkUTD8BCADWLy5d5IpJedHQQSXkC1VK/oAZlJEeBVpSZjMCn8LiHaI9Wq3G
3Vp6wvsP1b3kssJGzVFNctdXt5tjvOLxvrEfRJuGfqHTKILByqLzkeyWawbFNfSQ
93/8OunfSTXC1Sx3hgsNXQuOrNVKrDAQUqT620/jj94xNIg09bLSxsjN6EeTvyiO
mtE9H1J03o9tY6meNL/gcQhxBvwuo205np0JojYBP0pOfN8l9hnIOLkA0yu4ZXig
oKOVmf4iTjX4NImIWldT+UaWTO18NWcCrujtgHueytwYLBNV5N0oJIP2VYuLZfSD
VYuPllv7c6O2UEOXJsdbQaVuzU1HLocDyipnABEBAAG0NG9wZW5TVVNFIFByb2pl
Y3QgU2lnbmluZyBLZXkgPG9wZW5zdXNlQG9wZW5zdXNlLm9yZz6JATwEEwECACYC
GwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAUCU2dN1AUJHR8ElQAKCRC4iy/UPb3C
hGQrB/9teCZ3Nt8vHE0SC5NmYMAE1Spcjkzx6M4r4C70AVTMEQh/8BvgmwkKP/qI
CWo2vC1hMXRgLg/TnTtFDq7kW+mHsCXmf5OLh2qOWCKi55Vitlf6bmH7n+h34Sha
Ei8gAObSpZSF8BzPGl6v0QmEaGKM3O1oUbbB3Z8i6w21CTg7dbU5vGR8Yhi9rNtr
hqrPS+q2yftjNbsODagaOUb85ESfQGx/LqoMePD+7MqGpAXjKMZqsEDP0TbxTwSk
4UKnF4zFCYHPLK3y/hSH5SEJwwPY11l6JGdC1Ue8Zzaj7f//axUs/hTC0UZaEE+a
5v4gbqOcigKaFs9Lc3Bj8b/lE10Y
=i2TA
-----END PGP PUBLIC KEY BLOCK-----

zypper import will show this fingerprint:

  Key Fingerprint:  22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 2048
  Key Created:      Mon 05 May 2014 10:37:40 AM CEST
  Key Expires:      Thu 02 May 2024 10:37:40 AM CEST
  Rpm Name:         gpg-pubkey-3dbdc284-53674dd4

This key was in the openSUSE-build-key package in /usr/lib/rpm/gnupg/keys/gpg-pubkey-3dbdc284-53674dd4.asc.

old openSUSE Backports signing key 2048 bit RSA

This key is used up to openSUSE Leap 15.4.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.5 (GNU/Linux)

mQENBFVoS3UBCAC2SATmg4+9L7G0FVrtWC34ltD+FUeaBbqcEn9mlFTJRSNcGdRd
0/lXOmTTIq0j7yxPXebyrEmMEDJ6wSdvH8seeO41iYe8dim0/qdlan7tRTkYiQVH
uMzwvyhF2wRgN0/GM+4/ELYV7+YMrHn1Ty5l0N6g4mTpe0OM5xCf0j3H/pAG40cv
y6+hMcmHTvEHrbH4+fJZxbPkV18BGCEWFAZlS5e+1M6STm4+FXKSX26oeYL/ZkT7
FkQGEyLMIqBSYMVV+ooidONy1Ct0WsgwKk+c0myZ2ZWgUoE1FhUeZgWXD3t3eJbV
6L1dMX3o51NX8nb6YcV3GYXObjjvIgFVnnnNABEBAAG0Rm9wZW5TVVNFOkJhY2tw
b3J0cyBPQlMgUHJvamVjdCA8b3BlblNVU0U6QmFja3BvcnRzQGJ1aWxkLm9wZW5z
dXNlLm9yZz6JAT4EEwECACgFAmGg7o8CGwMFCRBXUxoGCwkIBwMCBhUIAgkKCwQW
AgMBAh4BAheAAAoJEJwhTUBlF2VlB14H/3XlaiL/2FwRRkrh9VIiBk90pz50C4DJ
BitxFzJX5rDFKkzijizqxeIn+5kjgCsvtsCgfXWC1zY1nAeJn0/KRbIcyNskpZ2c
+mHg9931z7zztwX5N7TcgPOCyhGGgrPs8I3K4t3qyECT0OnG5wVYuENzJBHi9POI
IkGcrjTSxgi1M3HMbcGXQsNc+W08M8HIMS3rnEh6QSCIC8c9hjos22k1W52WdxrK
//qj9+08hn2O3R+UBKqrMokGR1oFwYPXVqte5oSw1JZ9+j8/jm+b3jG2j3o3eAIr
uGOZrgQnImXZxcWfZaplFmdcXT8f5mBuJ5VzlVZxvxJ+lVzaFZLNJwOIRgQTEQIA
BgUCVWhLdgAKCRA7MBG3a51lI3xLAKCqjianm4ZKLCxspXHKvPI1UKlfGwCfXj6l
bd2KrM801FeRkNevZOyNdxM=
=9UDk
-----END PGP PUBLIC KEY BLOCK-----

Zypper import will show this fingerprint:

  Key Fingerprint:  637B 32FF 3D83 F07A 7AE1 C40A 9C21 4D40 6517 6565
  Key Name:         openSUSE:Backports OBS Project <openSUSE:Backports@build.opensuse.org>
  Key Algorithm:    RSA 2048
  Key Created:      Fri 26 Nov 2021 03:26:23 PM CET
  Key Expires:      Sun 04 Feb 2024 03:26:23 PM CET
  Rpm Name:         gpg-pubkey-65176565-61a0ee8f

This key is in the openSUSE-build-key package in /usr/lib/rpm/gnupg/keys/gpg-pubkey-65176565-61a0ee8f.asc.

openSUSE:Signing Keys

Contents