jperkin
commented
3 years ago Just a comment on this part to begin with:
At this point, GPG_KEYRING_VERIFY=/opt/pkg/etc/gnupg/pkgsrc.gpg and VERIFIED_INSTALLATION=always are set in pkg_install.conf. However, /opt/pkg/etc/gnupg/pkgsrc.gpg does not exist (yet).
This isn't correct, the bootstrap should include that file, which contains the public signing key for the packages:
$ tar ztvf bootstrap-macos14-trunk-x86_64-20200716.tar.gz | grep gpg
-rw-r--r-- 0 root wheel 3835 Jul 16 11:55 ./opt/pkg/etc/gnupg/pkgsrc.gpgWithout that file, yes you'd hit problems as there wouldn't be a way to validate the signatures. However I think you might mean /opt/pkg/etc/pkgsrc.gpg that you refer to later?
Even though VERIFIED_INSTALLATION=always I am not prompted to approve installation of gnupg2 nor any of its dependencies. Is this because /opt/pkg/etc/gnupg/pkgsrc.gpg doesn't exist?
Package verification doesn't rely on GnuPG, it uses the netpgpverify library built into the pkg_install tools.
root@jdwhites-Mac etc # cat pkg_install.conf
GPG_KEYRING_PKGVULN=/opt/pkg/share/gnupg/pkgsrc-security.gpg
GPG_KEYRING_VERIFY=/opt/pkg/etc/pkgsrc.gpg`
There should be no need to do this, and there can be incompatibilities between the keys that GnuPG exports and what netpgpverify supports. If you really want to use GPG for verification (which you can, I just don't think there is any benefit in doing so, I spent a while implementing netpgpverify support so that external commands were not necessary) then you'll probably need to also update pkg_install.conf to include GPG=/path/to/gpg2.
I think it'd help to understand what you're trying accomplish. Everything is set up out of the box to automatically validate packages, as you can see from your initial pkgin in gnupg2 it worked fine (the packages wouldn't install if the verification failed). If you just want to verify the bootstrap tarball then the instructions should provide the commands required for that, and you don't need to change pkg_install.conf. If you want to build your own packages and sign them then that's a little more involved and is described here: https://github.com/joyent/pkgsrc/wiki/pkgdev:signing
Let me know if anything needs further explanation.
jdwhite
Fresh macOS Catalina install, following bootstrap instructions from https://pkgsrc.joyent.com/install-on-osx/.
Short version: after bootstrapping, installing gpg2 from the Joyent binary package repo, and importing the public signing key into a keychain pointed to by
GPG_KEYRING_VERIFYinpkg_install.confI am unable to validate as the Signature id in the signed package cannot be found:pkg_add: unable to verify signature: Signature key id 6d94c02e1f32a9ad not foundI've spend the last couple of days trying to validate packages signed with with my own key get the same results (different Signature key id of course). After much fiddling I finally decided that I must be doing something wrong and decided to start fresh with the Joyent bootstrap as a sanity check -- except it also fails for me.
Long version: here are the terminal logs from my install to show precisely what was done.