Date: Wed, 9 Sep 2015 10:56:20 +0200 From: Baptiste Daroussin <bapt@FreeBSD.org> To: Marko =?utf-8?B?Q3VwYcSH?= <marko.cupac@mimar.rs> Cc: freebsd-stable@freebsd.org Subject: Re: 10.2-RELEASE-p2 lost ability to bootstrap pkg with signature_type="pubkey" Message-ID: <20150909085620.GF38185@ivaldir.etoilebsd.net> In-Reply-To: <20150909091412.350c51ed@efreet> References: <20150908123838.238e5e74@efreet> <20150908212859.GD38185@ivaldir.etoilebsd.net> <20150909091412.350c51ed@efreet>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Wed, Sep 09, 2015 at 09:14:12AM +0200, Marko Cupać wrote: > On Tue, 8 Sep 2015 23:28:59 +0200 > Baptiste Daroussin <bapt@FreeBSD.org> wrote: > > > On Tue, Sep 08, 2015 at 12:38:38PM +0200, Marko Cupać wrote: > > > Hi, > > > > > > I just found out that 10.2-RELEASE-p2 lost ability to bootstrap pkg > > > with signature_type="pubkey". > > > > > > Quick search returns: > > > https://github.com/freebsd/pkg/issues/1309 > > > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=202622 > > > > > > I guess it is not hard to switch repo to fingerprints, however I > > > would not expect to lose this functionality by updating to > > > patchlevel. > > > > > Implemented in head: r287579 I will MFC it asap. And see if it cannot > > be added asap to a next patchlevel update. > > > > Best regards, > > Bapt > > Thanx! > > Just a few quick not-completely-related questions: poudriere has the > ability to sign repos with PKG_REPO_SIGNING_KEY, but not with external > command, right? Is there a plan to support it? Can I build packages in > poudriere without PKG_REPO_SIGNING_KEY, and sign repo later on with > external command? > First yes I plan to add the ability to sign the package used to bootstrap via PKG_REPO_SIGNING_KEY asap in poudriere. Second you can keep your current configuration of poudriere, the signing with pubkey works perfectly well. All you need to do is either via a poudriere post bulk hook or manually go in the directory where your packages lives (in the Latest directory) and echo -n "$(sha256 -q pkg.txz)" | openssl dgst -sha256 -sign /thekey \ -binary -out ./pkg.txz.pubkeysig Last if you want to do all the process manually: pkg repo /yourrepository /yourkey cd /yourrepositry/Latest echo -n "$(sha256 -q pkg.txz)" | openssl dgst -sha256 -sign /yourkey \ -binary -out ./pkg.txz.pubkeysig I will see if I can avoid the the extra command by merging the signing of the bootstrap bit directly into pkg repo, that would be more handy Best regards, Bapt [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlXv9DQACgkQ8kTtMUmk6EyO1gCaAlPUVYC027FtVWSXDnY8K77D LA4AnRHmdbX7Db1QzbsyilizkLlLYFpy =mZss -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150909085620.GF38185>