From owner-freebsd-ports@FreeBSD.ORG Fri Oct 10 19:47:41 2014 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 353AF9F5 for ; Fri, 10 Oct 2014 19:47:41 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id F06B9A26 for ; Fri, 10 Oct 2014 19:47:40 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.9/8.14.9) with ESMTP id s9AJleql006091 for ; Fri, 10 Oct 2014 19:47:40 GMT (envelope-from bdrewery@freefall.freebsd.org) Received: (from bdrewery@localhost) by freefall.freebsd.org (8.14.9/8.14.9/Submit) id s9AJleYl006089 for freebsd-ports@freebsd.org; Fri, 10 Oct 2014 19:47:40 GMT (envelope-from bdrewery) Received: (qmail 77956 invoked from network); 10 Oct 2014 14:47:39 -0500 Received: from unknown (HELO ?10.10.0.24?) (freebsd@shatow.net@10.10.0.24) by sweb.xzibition.com with ESMTPA; 10 Oct 2014 14:47:39 -0500 Message-ID: <543837CF.9070607@FreeBSD.org> Date: Fri, 10 Oct 2014 14:47:27 -0500 From: Bryan Drewery Organization: FreeBSD User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.1.2 MIME-Version: 1.0 To: scratch65535@att.net, freebsd-ports Subject: Re: PKG not quite ready for prime time References: <543817AA.8080305@gmx.de> <54381E16.9070609@FreeBSD.org> <1a8g3athvnun67c4kljhjtsjjlc30116j1@4ax.com> In-Reply-To: <1a8g3athvnun67c4kljhjtsjjlc30116j1@4ax.com> OpenPGP: id=6E4697CF; url=http://www.shatow.net/bryan/bryan2.asc Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="kqq3QeW6OLOKMpAN4rD1nMFHu3po4bbAC" X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Oct 2014 19:47:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --kqq3QeW6OLOKMpAN4rD1nMFHu3po4bbAC Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 10/10/2014 1:12 PM, scratch65535@att.net wrote: > On Fri, 10 Oct 2014 12:57:42 -0500, Brian Drewery wrote: >=20 >> find /usr/share/keys/pkg -exec sha256 {} + >=20 > No such file That's your problem. You are missing the signature fingerprints to compare against. As such Pkg is refusing to do anything to prevent MITM attacks. You are missing this: https://www.freebsd.org/security/advisories/FreeBSD-EN-14:03.pkg.asc freebsd-update can provide it. --=20 Regards, Bryan Drewery --kqq3QeW6OLOKMpAN4rD1nMFHu3po4bbAC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iQEcBAEBAgAGBQJUODfPAAoJEDXXcbtuRpfPVz4H/0k98Oa8kabDqDnOhGr777vd 2jFealBzO4AO5j7CpVpw86gX4tfFTFx32MhAIQQscKA6qzeXSRsYskNOfe0fojku /298T9ftICKVwaRI+eRPnfB2Ba848Y6H2EcDmMYc6vhHCug4kWCfol4NR2y7Pcj3 of5XgZnHCc0am8wYLu/KdBPtIi8ykiBpd+Whj/0WSKAreJ1zEsTl9VxCoiDPt6oV JD6AQFB/VBah05EDCWzjED3IdXbd5z52enD/pWK4xuSP3hGZuhPsy5lLW/Z4uI3Y zSRryjwj8JnCuSQWbJcnmXStGMsrLmMpHH40eo9qTZpbHu7IHOP/Jru97niVJ9E= =2N1I -----END PGP SIGNATURE----- --kqq3QeW6OLOKMpAN4rD1nMFHu3po4bbAC--