Overview

A RPM file consists of the lead, a RPM signature and a RPM header followed by a CPIO archive.

The lead is not used any more. All informations are obsolete or are duplicated in the RPM signature and RPM header. But the lead is used to recognize rpm files with the file command. See here to find out how the lead is organized.

The RPM signature and RPM header share the same datastructure. They consist of a header, a number of indexes and a store.

The header contains the number of indexes that follow the header and the size of the store.

Every index describes a bit of data stored in the store. It consist of a tag (see signature tags and header tags), a data type, an offset in the store and a count, describing the number of items stored as the described data type.

Allowed data types are:

Dataspecs

RPM Lead

   unsigned char magic[4];     (4  byte)  (ed ab ee db)
   unsigned char major, minor; (1  byte each)
   short type;                 (2  byte)
   short archnum;              (2  byte)
   char name[66];              (66 byte)
   short osnum;                (2  byte)
   short signature_type;       (2  byte)
   char reserved[16];          (16 byte)
                               =96 byte
         

Header

   unsigned char magic[3];     (3  byte)  (8e ad e8)
   unsigned char version;      (1  byte)
   char reserved[4];           (4  byte)
   int num_index;              (4  byte)
   int num_data;               (4  byte)
                               =16 byte
         

Index

   int tag;                    (4  byte)
   int type;                   (4  byte)
   int offset;                 (4  byte)
   int count;                  (4  byte)
                               =16 byte
         

RPM Signature

Allowed tags

RPM Header

Allowed tags

Reference

For further informations on rpm see www.rpm.org. You can find there the book Maximum RPM and the source for rpm.