In order to add security to RPM packages used during a build, you can take steps to securely sign them. Once a signature is verified, the OpenEmbedded build system can use the package in the build. If security fails for a signed package, the build system aborts the build.
This section describes how to sign RPM packages during a build and how to use signed package feeds (repositories) when doing a build.