*** UNIX MANUAL PAGE BROWSER ***

PKG_SIGN(1) FreeBSD General Commands Manual PKG_SIGN(1) NAME pkg_sign - sign binary packages for distribution SYNOPSIS pkg_sign [-Cvi] [-D name[=value]] [-j maxjobs] [-o dir] -s signify2 -s privkey [-S source] [pkg-name ...] DESCRIPTION The pkg_sign command is used to sign existing collections of binary packages created by pkg_create(1). It will sign the packages and optionally, produce a SHA256 manifest file in the output directory. The options are as follows: -C Append sha256(1) checksums to SHA256 in the output directory, then sort it. -i Incremental mode. Ignore packages that are already in the output repository. Note that, in verbose mode, they will still show up as `Signed' in the listing. -j maxjobs Sign existing packages in parallel. -o dir Specify output directory for signing packages. Otherwise, signed packages are created in the current directory. -S source Source repository for packages to be signed. -s signify2 -s privkey Specify signature parameters for signed packages. Option parameters are as follows: signify2 Choose signify(1) new style signatures, where the gzip(1) compressed data is signed. privkey The path to the signer's private key. For signify, the private key name is used to set the @signer annotation. If a corresponding public key is found, the first signatures will be checked for key mismatches. -v Turn on verbose output, display `Signed output/pkg.tgz' after each package is signed. SIGNATURE DETAILS The signature is stored within the gzip(1) comment, as plain text data, according to signify(1) -zS mode. It contains the ed25519 signature, some meta-information, and SHA512/256 checksums for each 64K block of compressed data. Additionally, for further manual checking, the packing-list contains a complete manifest of files within the package, checksummed with sha256(1) and annotated with proper @mode, @user, @group annotations, so that pkg_add(1) will refuse to give special rights to any file which isn't properly annotated, and so that it will abort on installation of a file whose checksum does not match. Meta-information from signify(1) gets inserted in the packing-list during extraction, adding a @digital-signature annotation and a @signer annotation for further manual inspection. SEE ALSO cksum(1), pkg_add(1), signify(1), tar(1), package(5) HISTORY The pkg_sign command first appeared in OpenBSD 5.5. The signature process was completely redesigned for OpenBSD 6.1. AUTHORS Marc Espie FreeBSD 14.1-RELEASE-p8 February 11, 2022 FreeBSD 14.1-RELEASE-p8