Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (
Help us improve Python packaging - Donate today!

Signs release files

Project Description

A helper tool to quickly crawl a file system and sign commonly used files for repositories, with gpg, rpm-sign, and any other similar tool.

“a tool called “merfi” … what could possibly go wrong?”


For rpm-sign, the default operation will just crawl the filesystem looking for Debian repositories containing Release files. When the proper Release file is found, merfi will proceed to sign the file like:

$ merfi rpm-sign --key "mykey"
--> signing: /Users/alfredo/repos/debian/dists/trusty/Release
--> signed: /Users/alfredo/repos/debian/dists/trusty/Release.gpg
--> signed: /Users/alfredo/repos/debian/dists/trusty/InRelease

Like all the other supported backends, it will crawl from the current working directory unless a path is specified:

$ merfi rpm-sign --key "mykey" /opt/packages

What is really doing behind the scenes is using rpm-sign like this:

rpm-sign --key "mykey" --detachsign Release --output Release.gpg
rpm-sign --key "mykey" --clearsign Release > InRelease

You can also specify a --keyfile argument to rpm-sign. This will cause merfi to copy this GPG public key as release.asc to the root of each repository:

$ merfi rpm-sign --key "mykey" --keyfile /etc/RPM-GPG-KEY-testing /opt/packages

This feature is designed for Ceph’s ISO installer (ceph-ansible), because it expects the GPG public key to be present in this location.

If you are running the rpm-sign command on a computer that is behind a NAT, you must pass the --nat argument, like so:

$ merfi rpm-sign --nat --key "mykey"


GPG support is similar to rpm-sign in that merfi will crawl a path (defaults to the current working directory) looking for Debian repositories, and sign the appropriate Release files:

$ merfi gpg –> signing: /Users/alfredo/repos/debian/dists/trusty/Release –> signed: /Users/alfredo/repos/debian/dists/trusty/Release.gpg –> signed: /Users/alfredo/repos/debian/dists/trusty/InRelease

Behind the scenes the tool is running gpg like:

gpg --armor --detach-sig --output Release.gpg Release
gpg --clearsign --output InRelease Release


merfi can generate an ISO from a tree of package repositories:

$ merfi iso /opt/packages --output my-dvd.iso

This will generate two files, my-dvd.iso and my-dvd.iso.SHA256SUM. You can verify the ISO file’s integrity by passing the checksum file to the sha256sum -c command:

$ sha256sum -c my-dvd.iso.SHA256SUM
my-dvd.iso: OK

About the name

“Firme” is the Spanish word for “sign” and “merfi” is the Peruvian slang for it.

Release History

Release History

This version
History Node


History Node


History Node


History Node


History Node


History Node


Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
merfi-1.3.3.tar.gz (20.1 kB) Copy SHA256 Checksum SHA256 Source Nov 20, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting