macports · neverpanic · Jun 6, 2020 · Jun 6, 2020 · Jun 6, 2020 · Jun 6, 2020
diff --git a/.gitignore b/.gitignore
@@ -13,6 +13,8 @@ doc/.dep
 doc/macports.conf
 doc/pubkeys.conf
 
+keys/*/*.sec
+
 Mk/macports.autoconf.mk
 
 portmgr/dmg/postflight
@@ -55,5 +57,6 @@ vendor/tcl8.*/unix/tclsh
 Makefile
 pkgIndex.tcl
 !vendor/tcllib*/**/pkgIndex.tcl
+!vendor/signify-osx/Makefile
 
 /dist/
diff --git a/Makefile.in b/Makefile.in
@@ -36,6 +36,9 @@ install::
 	$(INSTALL) -d -o "${DSTUSR}" -g "${DSTGRP}" -m "${DSTMODE}" "$(DESTDIR)${datadir}/macports/"
 	$(INSTALL)    -o "${DSTUSR}" -g "${DSTGRP}" -m 444 setupenv.bash  "$(DESTDIR)${datadir}/macports/"
 	$(INSTALL)    -o "${DSTUSR}" -g "${DSTGRP}" -m 444 $(srcdir)/macports-pubkey.pem  "$(DESTDIR)${datadir}/macports/"
+	$(INSTALL) -d -o "${DSTUSR}" -g "${DSTGRP}" -m "${DSTMODE}" "$(DESTDIR)${datadir}/macports/keys"
+	$(INSTALL) -d -o "${DSTUSR}" -g "${DSTGRP}" -m "${DSTMODE}" "$(DESTDIR)${datadir}/macports/keys/base"
+	$(INSTALL)    -o "${DSTUSR}" -g "${DSTGRP}" -m 444 $(srcdir)/keys/base/macports-base-2020.pub  "$(DESTDIR)${datadir}/macports/keys/base/"
 # Only run these scripts when not building in a destroot
 ifeq ($(DESTDIR),)
 # create run user if it doesn't exist

diff --git a/doc/macports.conf.5 b/doc/macports.conf.5
@@ -436,39 +436,90 @@ T}
 .sp 1
 .RE
 .PP
-rsync_server
+release_version_url
 .RS 4
-Default rsync server to connect to when running "selfupdate" through the port com\- mand to update your base MacPorts infrastructure\&. While selfupdate also syncs the ports tree, it uses the settings from ${sources_conf} to do so\&.
+URL that MacPorts attempts to download to find out whether a new version was released\&. Can be specified multiple times; only one of the URLs needs to be available\&. Downloads will be attempted in the specified order\&.
 .TS
 tab(:);
 lt lt.
 T{
 \fBDefault:\fR
 T}:T{
-rsync\&.macports\&.org
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\m[blue]\fBhttps://raw\&.githubusercontent\&.com/macports/macports\-base/master/config/RELEASE_URL\fR\m[]
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\m[blue]\fBhttps://trac\&.macports\&.org/export/HEAD/macports\-base/config/RELEASE_URL\fR\m[]
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+\m[blue]\fBhttps://distfiles\&.macports\&.org/MacPorts/RELEASE_URL\fR\m[]
+.RE
+.sp
 T}
 .TE
 .sp 1
 .RE
 .PP
-rsync_dir
+release_url
 .RS 4
-Rsync directory from which to pull MacPorts sources from the rsync server\&.
+URL where MacPorts will download a new source code archive, if the release_version_url indicates that the current version needs to be updated\&. In this URL,
+\fB{version}\fR
+will be replaced with the version number determined from release_version_url\&.
+
+Additionally, "\&.sig" will be appended to this URL, downloaded, and used to verify a signature made with one of the keys in
+\fB$prefix/share/macports/keys/base/\fR
+using the signify(1) utility\&.
+
+The list of distfile mirrors will automatically be appended to this option\&.
 .TS
 tab(:);
 lt lt.
 T{
 \fBDefault:\fR
 T}:T{
-macports/release/base/ (which pulls sources for the currently shipping MacPorts release)
+\fBhttps://github\&.com/macports/macports\-base/releases/download/v{version}/MacPorts\-{version}\&.tar\&.bz2\fR
 T}
 .TE
 .sp 1
 .RE
 .PP
+rsync_server
+.RS 4
+Obsolete\&. Remove this from your configuration\&.
+.RE
+.PP
+rsync_dir
+.RS 4
+Obsolete\&. Remove this from your configuration\&.
+.RE
+.PP
 rsync_options
 .RS 4
-Default rsync options to use when connecting to the rsync server\&.
+Default rsync options to use when connecting to the rsync server to sync the ports tree\&.
 .TS
 tab(:);
 lt lt.

diff --git a/doc/macports.conf.5.txt b/doc/macports.conf.5.txt
@@ -153,20 +153,37 @@ destroot_umask::
     Umask value to use during the destrooting of a port.
     *Default:*;; 022
 
+release_version_url::
+    URL that MacPorts attempts to download to find out whether a new version was
+    released. Can be specified multiple times; only one of the URLs needs to be
+    available. Downloads will be attempted in the specified order.
+    *Default:*;;
+      - https://raw.githubusercontent.com/macports/macports-base/master/config/RELEASE_URL
+      - https://trac.macports.org/export/HEAD/macports-base/config/RELEASE_URL
+      - https://distfiles.macports.org/MacPorts/RELEASE_URL
+
+release_url::
+    URL where MacPorts will download a new source code archive, if the
+    release_version_url indicates that the current version needs to be updated.
+    In this URL, *\{version\}* will be replaced with the version number determined
+    from release_version_url.
+    +
+    Additionally, ".sig" will be appended to this URL, downloaded, and used to
+    verify a signature made with one of the keys in
+    *$prefix/share/macports/keys/base/* using the signify(1) utility.
+    +
+    The list of distfile mirrors will automatically be appended to this option.
+    *Default:*;; *https://github.com/macports/macports-base/releases/download/v\{version\}/MacPorts-\{version\}.tar.bz2*
+
 rsync_server::
-    Default rsync server to connect to when running "selfupdate" through the
-    port com- mand to update your base MacPorts infrastructure. While selfupdate
-    also syncs the ports tree, it uses the settings from $\{sources_conf\} to do
-    so.
-    *Default:*;; rsync.macports.org
+    Obsolete. Remove this from your configuration.
 
 rsync_dir::
-    Rsync directory from which to pull MacPorts sources from the rsync server.
-    *Default:*;; macports/release/base/ (which pulls sources for the currently shipping
-    MacPorts release)
+    Obsolete. Remove this from your configuration.
 
 rsync_options::
-    Default rsync options to use when connecting to the rsync server.
+    Default rsync options to use when connecting to the rsync server to sync the
+    ports tree.
     *Default:*;; -rtzvl --delete-after
 
 binpath::

diff --git a/doc/macports.conf.in b/doc/macports.conf.in
@@ -109,21 +109,26 @@ variants_conf       	@MPCONFIGDIR_EXPANDED@/variants.conf
 # Keep logs after successful installations.
 #keeplogs            	no
 
-# The rsync server for fetching MacPorts base during selfupdate. This
-# setting is NOT used when downloading ports trees; ports trees are
-# configured using the file referenced by sources_conf. See
-# https://trac.macports.org/wiki/Mirrors#MacPortsSource for a list of
-# available servers.
-#rsync_server        	rsync.macports.org
-
-# Location of MacPorts base sources on rsync_server. If this references
-# a .tar file, a signed .rmd160 file must exist in the same directory
-# and will be used to verify its integrity. See
-# https://trac.macports.org/wiki/Mirrors#MacPortsSource to find the
-# correct rsync_dir for a particular rsync_server.
-#rsync_dir           	macports/release/tarballs/base.tar
-
-# Options to pass to rsync when fetching MacPorts base and the ports tree.
+# URL that MacPorts attempts to download to find out whether a new version was
+# released. Can be specified multiple times; only one of the URLs needs to be
+# available. Downloads will be attempted in the specified order.
+#release_version_url https://raw.githubusercontent.com/macports/macports-base/master/config/RELEASE_URL
+#release_version_url https://trac.macports.org/export/HEAD/macports-base/config/RELEASE_URL
+#release_version_url https://distfiles.macports.org/MacPorts/RELEASE_URL
+
+# URL where MacPorts will download a new source code archive, if the
+# release_version_url indicates that the current version needs to be updated.
+# In this URL, {version} will be replaced with the version number determined
+# from release_version_url.
+#
+# Additionally, ".sig" will be appended to this URL, downloaded, and used to
+# verify a signature made with one of the keys in
+# $prefix/share/macports/keys/base/ using the signify(1) utility.
+#
+# The list of distfile mirrors will automatically be appended to this option.
+#release_url https://github.com/macports/macports-base/releases/download/v{version}/MacPorts-{version}.tar.bz2
+
+# Options to pass to rsync when fetching the ports tree.
 #rsync_options       	-rtzvl --delete-after
 
 # Type of generated StartupItems.

diff --git a/doc/port-selfupdate.1 b/doc/port-selfupdate.1
@@ -61,11 +61,11 @@ When no new versions are available, \fBselfupdate\fR looks like this:
 .\}
 .nf
 $ sudo port selfupdate
-\-\-\-> Updating MacPorts base sources using rsync
+\-\-\->  Checking for newer releases of MacPorts
 MacPorts base version 2\&.6\&.99 installed,
-MacPorts base version 2\&.6\&.99 downloaded\&.
-\-\-\-> Updating the ports tree
-\-\-\-> MacPorts base is already the latest version
+MacPorts base version 2\&.6\&.99 available\&.
+\-\-\->  MacPorts base is already the latest version
+\-\-\->  Updating the ports tree
 .fi
 .if n \{\
 .RE
@@ -78,12 +78,13 @@ If \fBselfupdate\fR detects that a newer version of MacPorts is available, it at
 .\}
 .nf
 $ sudo port selfupdate
-\-\-\-> Updating MacPorts base sources using rsync
-MacPorts base version 2\&.3\&.0 installed,
-MacPorts base version 2\&.6\&.99 downloaded\&.
-\-\-\-> Updating the ports tree
-\-\-\-> MacPorts base is outdated, installing new version 2\&.6\&.99
-Installing new MacPorts release in /opt/local as root:admin; permissions 755
+\-\-\->  Checking for newer releases of MacPorts
+MacPorts base version 2\&.6\&.0 installed,
+MacPorts base version 2\&.6\&.99 available\&.
+\-\-\->  MacPorts base is outdated, installing new version 2\&.6\&.99
+\-\-\->  Attempting to fetch MacPorts 2\&.6\&.99 source code from https://github\&.com/macports/macports\-base/releases/download/v2\&.6\&.99/MacPorts\-2\&.6\&.99\&.tar\&.bz2
+\-\-\->  Extracting MacPorts 2\&.6\&.99
+\-\-\->  Installing new MacPorts release in /opt/local as root:admin; permissions 0755
 .fi
 .if n \{\
 .RE
@@ -96,7 +97,7 @@ Network Problems
 .RS 4
 MacPorts uses the
 \fIrsync\fR
-protocol to update its sources to the latest version\&. This will fail if you are on a network that blocks TCP connections to the rsync port 873\&. Talk to your network administrators and ask them to allow connections to port 873 if this happens to you\&. Alternatively, you can just download a new installer \&.pkg from macports\&.org and run that to upgrade your installation\&.
+protocol to update its ports tree to the latest version\&. This will fail if you are on a network that blocks TCP connections to the rsync port 873\&. Talk to your network administrators and ask them to allow connections to port 873 if this happens to you\&. Alternatively, you can just download a new installer \&.pkg from macports\&.org and run that to upgrade your installation\&.
 .sp
 Network connection problems might also affect you if you are in a country with US export restrictions\&. We suggest using one of our other
 \m[blue]\fBmirrors\fR\m[]\&\s-2\u[1]\d\s+2
@@ -144,7 +145,7 @@ $ sudo port \-d selfupdate
 .RS 4
 .\}
 .nf
-(C) 2014 The MacPorts Project
+(C) 2014\-2020 The MacPorts Project
 Clemens Lang <cal@macports\&.org>
 .fi
 .if n \{\

diff --git a/doc/port-selfupdate.1.txt b/doc/port-selfupdate.1.txt
@@ -50,11 +50,11 @@ When no new versions are available, *selfupdate* looks like this:
 [subs="verbatim,attributes"]
 ----
 $ sudo port selfupdate
----> Updating MacPorts base sources using rsync
+--->  Checking for newer releases of MacPorts
 MacPorts base version {manversion} installed,
-MacPorts base version {manversion} downloaded.
----> Updating the ports tree
----> MacPorts base is already the latest version
+MacPorts base version {manversion} available.
+--->  MacPorts base is already the latest version
+--->  Updating the ports tree
 ----
 
 If *selfupdate* detects that a newer version of MacPorts is available, it
@@ -64,12 +64,13 @@ different:
 [subs="verbatim,attributes"]
 ----
 $ sudo port selfupdate
----> Updating MacPorts base sources using rsync
-MacPorts base version 2.3.0 installed,
-MacPorts base version {manversion} downloaded.
----> Updating the ports tree
----> MacPorts base is outdated, installing new version {manversion}
-Installing new MacPorts release in /opt/local as root:admin; permissions 755
+--->  Checking for newer releases of MacPorts
+MacPorts base version 2.6.0 installed,
+MacPorts base version {manversion} available.
+--->  MacPorts base is outdated, installing new version {manversion}
+--->  Attempting to fetch MacPorts {manversion} source code from https://github.com/macports/macports-base/releases/download/v{manversion}/MacPorts-{manversion}.tar.bz2
+--->  Extracting MacPorts {manversion}
+--->  Installing new MacPorts release in /opt/local as root:admin; permissions 0755
 ----
 
 TROUBLESHOOTING
@@ -78,7 +79,7 @@ If *selfupdate* fails, it usually does so in one of two places: The network
 connection, or the installation of the update.
 
 Network Problems::
-MacPorts uses the 'rsync' protocol to update its sources to the latest version.
+MacPorts uses the 'rsync' protocol to update its ports tree to the latest version.
 This will fail if you are on a network that blocks TCP connections to the rsync
 port 873. Talk to your network administrators and ask them to allow connections
 to port 873 if this happens to you. Alternatively, you can just download a new
@@ -113,5 +114,5 @@ man:port[1], man:port-sync[1]
 
 AUTHORS
 -------
- (C) 2014 The MacPorts Project
+ (C) 2014-2020 The MacPorts Project
  Clemens Lang <cal@macports.org>
diff --git a/keys/base/macports-base-2020.pub b/keys/base/macports-base-2020.pub
@@ -0,0 +1,2 @@
+untrusted comment: macports base signing key 2020 public key
+RWRM3YcGvhgOS+29ui5vdr8fpnQgnJqDWZOFan3GnId11PbbRU6heAb5