Re: pkg_info -X: Add FILE_CKSUM (sha256)

[Thomas Klausner <wiz%netbsd.org@localhost>]

On Tue, Jan 06, 2026 at 03:59:36AM +0100, Taylor R Campbell wrote:
> The pkg_summary(5) file documents the following syntax:
> 
>      FILE_CKSUM
>              (optional) A checksum type supported by digest(1) and checksum
>              separated by space character.
> 
> But it was apparently never implemented in `pkg_info -X'.  This patch
> implements it, with SHA256 for now.
> 
> This allows a client to verify that the .tgz file it got by reference
> from a pkg_summary is the same as the one the pkg_summary meant.
> This is important for detecting version rollback attacks -- signing
> the package itself doesn't help.  (Patch to pkgin to verify the hashes
> coming.)
> 
> pkg_install already uses the NetBSD sha2(3) API in pkg_admin, so this
> brings in no new library dependencies.  (Any other hash might.)
> 
> OK?

The patch looks fine. I'm just curious about one thing:

Are there any common tasks that call 'pkg_info -X' and will now be
slowed down because every file listed in the summary file will now be
read?

Thanks,
 Thomas