[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: Call for tests: pkg_install-renovation
On Mon, May 26, 2008 at 11:26:08AM +0200, Hubert Feyrer wrote:
> On Sun, 25 May 2008, Joerg Sonnenberger wrote:
>> To sign a package, use
>> pkg_admin sign-package pkg.tgz signed/pkg.tgz \
>> .../private/cakey.pem .../newcerts/00.pem
> cool... personally I'd expect that functionality in pkg_create instead of
> pkg_admin. maybe that can be moved?
It takes an existing package and I would prefer to keep pkg_create
focused on that part. It is bad enough that it has to provide the logic
for registering as well.
Another good reason to keep it in pkg_admin: you also need support to
check the signature and that doesn't make any sense in pkg_create :-)
>> The signature check is enabled by setting VERIFIED_INSTALLATION
> In the environment, I guess?
Currently only in pkg_install.conf. Man page is about to be committed.
I would prefer to not have to look in the environment, but I am open on
> Can you tell how to do the verification "manually" (using openssl?)
> for all our openssl-neophytes out there that don't want to install a
> package (or even run netbsd/pkgsrc) to check the signature?
It is a bit tricky as the signatures are created in a way to allow
streaming installation from FTP. A signed package is normally an
ar(1)chive, containing three entries:
(the latter just named after the package). It doesn't really really if
it is ar(1) or some other supported archive format, but it does care
about the order.
The third file should be obvious. The second file is the PKCS7 signature
of the first, it can be validated e.g. with nbsvtool(1). The first file
is the description of the package. It looks for example like:
--- cut here ---
block size: 65536
file size: 36854
end pkgsrc signature
--- cut here ---
The last part before "end pkgsrc signature" is the hash of each blocks.
Validated this is the tricky part, it will require some use of split(1)
or so :-) It is not recommented to create the files by hand as the
parser is pretty dumb^Wstrict.
Main Index |
Thread Index |