Feature Request: Allow pubkey validation with pkg bootstrap

[lattera]

pkg bootstrap currently doesn't support signature_type="pubkey". It either needs to or the pubkey signature type should be removed entirely in favor of fingerprints. This is a problem with downstream distributions like HardenedBSD who use signature_type="pubkey" and haven't yet made the switch to fingerprints due to lack of documentation surrounding fingerprints.

[infracaninophile]

On 22/08/2015 19:27, Shawn Webb wrote:

pkg bootstrap currently doesn't support signature_type="pubkey".
It either needs to or the pubkey signature type should be removed
entirely in favor of fingerprints. This is a problem with downstream
distributions like HardenedBSD who use signature_type="pubkey" and
haven't yet made the switch to fingerprints due to lack of
documentation surrounding fingerprints.

The pkg that checks signatures during bootstrap is pkg(7) which is part
of the base system. This is not something that can be changed that
readily in release branches. It doesn't necessarily support all of the
signature types available to the full pkg(8).

It is probably going to be more productive for you to investigate
exactly how fingerprints work and satisfy yourself they are an effective
means of authenticating the initial installation of pkg(8).

Cheers,

Matthew

[lattera]

I guess the question stems down to: should pubkey signature type be added to pkg(7) or removed from pkg(8)? In case of the former, FreeBSD's bugzilla would likely be the place. In case of the latter, this bug report is the place.

[bapt]

The former, given pubkey is for now our only "simple mechanism" for signing. I have been willing to add it to pkg(7) for a while, but never found time

[lattera]

Yeah. It really would've been nice to have it supported. I'm having to rework how we in HardenedBSD build packages. It seems that Poudriere doesn't support building package repos that use the fingerprint signature type. I end up having to re-run the pkg repo command with the signing_command option. I also have to manually generate the .sig file for pkg.txz. How does FreeBSD do it?

[lattera]

Bugzilla ticket opened in FreeBSD: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=202622