File:  [NetBSD Developer Wiki] / wikisrc / users / spz / pkgsig.mdwn
Revision 1.3: download - view: text, annotated - select for diffs
Tue Oct 3 03:08:22 2017 UTC (5 years, 2 months ago) by wiki
Branches: MAIN
CVS tags: HEAD
web commit by spz: what I found out over the weekend

    1: ## pkgsig
    3: - gpg for now
    4: - master packages-signing signing key, which signs keys that are good for one arch/os-version/quarterly
    5: - agc wants the signing to be done under human control; change the rsync task to send mail to the pbulk admin. Wait until the bulk signing is done and use a lock file to indicate it's time to sync? Or just start the rsync manually in a script that also does the signing?
    7: ### how does signing work? do we have tools to sign an entire harvest of packages in one go?
    8: signing is done using pkg_admin from the pkgtools/pkg_install package; pkg_admin gpg-sign-package <src> <dest>
   10: signed packages are ar archives:
   12:     +PKG_HASH
   14:     p5-DateTime-Format-W3CDTF-0.07nb1.tmp.tgz
   16: The tools want to sign each package as it is built. Joyent uses gpg-agent for that, so no bulk-signing toos yet, however signing packages later is not hard, so to batch sign,
   18:     for i in $unsigned; do
   19:       mv $i ${i%.tgz}.tmp.tgz
   20:       pkg_admin gpg-sign-package ${i%.tgz}.tmp.tgz signedpkgs/$i
   21:     done
   23: This still wants the passphrase for every single package, so flank with gpg-agent. Does gpg-agent have an issue with chroots? It wouldn't work in the build chroot but may simply have issues due to both gnupg and gnupg2 being installed.
   25: pkg_install from pkgsrc currently has some issues when encountering a signed package with pkg_add: you can't install it unless you have the means to verify it first, even if you expressly do not want to verify it. Base pkg_add complains but installs.

CVSweb for NetBSD wikisrc <> software: FreeBSD-CVSweb