Enable the FreeBSD-base repository in all of the /etc/pkg/FreeBSD.conf
variants, and remove code from various install paths which enabled the
repository via /usr/local/etc/pkg/repos/FreeBSD.conf.
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D60946
This allows pkg(7) to be used to bootstrap a jail or chroot, and to
recognize the -j and -r options and pass them through to pkg(8) if
already bootstrapped.
Note that this does not address the issue of repository keys. If using
a signed package repository, you will still need to copy /usr/share/keys
into the target environment before or after bootstrapping, or pkg will
be unable to verify package signatures.
MFC after: 1 week
Reviewed by: imp, bapt
Differential Revision: https://reviews.freebsd.org/D58165
The files /usr/sbin/pkg/FreeBSD.conf.* currently set base repo to {enable: no}.
We don't want to overwrite /local/etc/pkg/repos/FreeBSD.conf that already exists
when users choose tech preview in the installation.
Signed-off-by: Guilherme Augusto de Souza Candinho <[email protected]>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1925
Rather than fetching packages directly from the CDN which currently
backs pkgbase.freebsd.org, requests will go to pkg.freebsd.org mirrors
and be 302ed to the correct servers. This adds ~70 seconds to the
process of installing or upgrading a pkgbase system; it also orphans
systems with 15.0-{PRERELEASE,ALPHA*,BETA*} installed since they are
expecting to see pkgbase files signed with the pkg keys, not the new
pkgbase signing keys.
Reviewed by: dch, philip
MFC after: immediately (for 15.0-RELEASE)
With hat: re
Requested by: clusteradm, core
Differential Revision: https://reviews.freebsd.org/D53964
On -CURRENT and -STABLE this gets bits from pkg.freebsd.org; but we get
base system bits from pkgbase.freebsd.org for BETA/RC/RELEASE.
Note that this repository is disabled by default, but can still be used
by explicitly specifying it, e.g. "pkg upgrade -r FreeBSD-base".
With hat: re
MFC after: 8 hours (needed in 15.0-RC1)
If build logic breaks such that we can't figure out which branch we're
on, we should error out rather than shipping a default (and probably
wrong) /etc/pkg/FreeBSD.conf
Reviewed by: ivy
MFC after: 5 minutes
Suggested by: ivy
Differential Revision: https://reviews.freebsd.org/D53487
With pkgbase being the New Way Of Doing Things in FreeBSD 15.0, it is
unnecessarily confusing to have a repository called "FreeBSD" which
contains packages built from the FreeBSD ports tree but not from the
FreeBSD src tree. Bite the bullet and change it now rather than
having an even more painful transition later.
With hat: re@
Bikeshed on: freebsd-current, freebsd-ports
Relnotes: The "FreeBSD" and "FreeBSD-kmods" repositories defined
in /etc/pkg/FreeBSD.conf have been renamed to
FreeBSD-ports and FreeBSD-ports-kmods respectively.
Users who override these in /usr/local/etc/pkg/repos
will need to adjust their configuration to match the
new names.
Now that this file lists two repositories, the text "to disable *this*
repository" no longer makes sense. Also, expand the example to list
how to disable both FreeBSD and FreeBSD-kmods repositories.
Reported by: Graham Perrin
MFC after: 3 days
The kmod repositories were added shortly after 14.2-RELEASE. Point at
them here so that users don't need to manually add the configuration
in order to get e.g. working graphics.
MFC after: 1 minute
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D50583
pkg(7) does not understand all the options that pkg(8) understands and
should never log errors about unknown options that it will pass on to
pkg(8) without touching.
PR: 286510
Reviewed by: bapt
Fixes: be61deae0a ("pkg: clarify argument parsing")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D50163
Currently pkg parses all arguments and subcommands in a single
getopt_long() loop. This results in quite a bit of accidental
complexity, especially around the -r option for the bootstrap and add
subcommands.
This also results in the undocumented behavior of all options understood
by pkg(7) being accepted anywhere in the argument list regardless of
their position. This contradicts the behavior of pkg(8) and I find it
quite unexpected.
This patch splits the argument parsing done by pkg(7) into two phases
for global options and subcommand options. This gives behavior that
matches pkg(8), accepting the subset of pkg(8) options supported by
pkg(7) in the exact same positions that pkg(8) accepts them.
This is however a somewhat breaking change, as options are no longer
accepted by pkg(7) in places they are rejected by pkg(8). For example,
`pkg -f bootstrap` no longer works, only `pkg bootstrap -f`.
The original motivation for writing this patch was investigating support
for --rootdir in pkg(7). Since pkg(8) uses -r as the short form for
both --rootdir and --repository depending on the position, I decided
that pkg(7) needed to be brought inline with pkg(8)'s argument parsing
behavior to avoid confusion.
This patch also gets rid of args_add_message (unused since 40b9f924b1)
Relnotes: yes
Reviewed by: bapt
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D49977
- Fix allocation size in config_get_repositories().
- Fix a memory leak in read_conf_file().
- Avoid a null pointer dereference in an error path in
verify_pubsignature().
Fixes: e3b4a51580 ("pkg(7): expand VERSION_MAJOR, VERSION_MINOR, RELEASE and OSNAME")
Fixes: dc4581589a ("pkg: clean support for repositories")
Catchup with pkg(8) by expanding more variable when parsing repositories
The only missing variable now is ARCH, this will have to wait for
pkg 2.0 to be the lowest supported version.
with pkg(8) it is possible to overwrite a configuration like adding
FreeBSD {
enabled: false
}
in /usr/local/etc/pkg/repo/overwrite.conf which allows to change any
value which can have been reviously configured in anything in
/etc/pkg/*.conf
now the bootstrap supports the same
MFC After: 3 weeks
pkg.pkg has been available for years and is the default in all supported
releases. Retire fallback support for pkg.txz.
Reviewed by: bapt
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46990
Rework the way the bootstrap fetches pkg, by implementing a full support
for the repositories, the boostrap will now loop over all available repo
and try to fetch the full package from there. It will at the first valid
package found.
Fallback to packagesite (which has been deprecated for a while) if needed, by
transforming it into a repo, if no repo is found.
MFC After: 3 weeks
My local environment seems to be seeing some pollution; we need
<string.h> for strlen.
PR: 284021
Fixes: 2e065d74a5 ("pkg: add a pkgsign_verify_data [...]")
MFC after: immediately (trivial build fix)
Signature types need to be parsed out of the key/signature information
that we are presented with from the files we download. We use that to
understand whicher signer we need to dispatch to.
The ECC signer is more-or-less lifted from pkg(8), with some changes to
slim it down for pkg(7).
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D48108
This will be used to verify raw payloads, as if signed by pkg-key(8).
It will be used specifically in pkg(7) to verify .pubkeysig as published
by poudriere.
Amend verify_pubsignature() now to use it. For the RSA signer, we need
to verify using a sha256 of the data instead of the data itself.
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D48109
We already have to do this for reading the pubkey, just pull it out for
other uses. The ECC signer will use this to verify the bootstrap if
the PUBKEY mechanism is used.
Reviewed by: bapt, emaste
Differential Revision: https://reviews.freebsd.org/D48107
This mirrors a change we made in pkg(8), and will be used to next add
another signer that does ECC.
Reviewed by: bapt, emaste
Differential Revision: https://reviews.freebsd.org/D48106
We'll eventually add a pkgsign abstraction over these similar to how we do
in pkg(8), but start by isolating these parts.
Reviewed by: bapt, emaste
Differential Revision: https://reviews.freebsd.org/D48105
.pkg is the default extension as of commit c244b1d8a3, falling back to
.txz if not found.
PR: 281924
Reviewed by: bapt
Fixes: a2aac2f5e5 ("pkg(7): when bootstrapping first search for pkg.bsd file then pkg.txz")
Fixes: c244b1d8a3 ("pkg: settle the uniq extension to .pkg instead of .bsd")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46977
Apply the following automated changes to try to eliminate
no-longer-needed sys/cdefs.h includes as well as now-empty
blank lines in a row.
Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/
Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/
Remove /\n+#if.*\n#endif.*\n+/
Remove /^#if.*\n#endif.*\n/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/
Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/
Sponsored by: Netflix
Previously the local ABI string was written to an on-stack buffer and
the pointer to that buffer was saved in a global before the function
returned. This had two issues: c[ABI].val pointed to a
no-longer-valid on-stack buffer after config_init returned, and the
string could potentially be truncated. Fix both of those by changing
pkg_get_myabi to return a pointer to a string allocated by asprintf.
Note that the allocated string is left in the global config array
until it is implicitly freed on process exit.
Reported by: GCC 13 -Wdangling-pointer
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D42623
Switch the repository to use https by default, base is providing a CA
root bundle suitable to validate the certificates used by the project.
This can now be activated without requiring another packages to be installed
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D40473
The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.
Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix
Use SHA256_Fd and SHA256_Data instead of home made equivalent.
wrap those functions into hash.c to avoid header collition between
openssl and libmd
Suggested by: kevans
OpenSSL 3.0 has deprecated the sha256 api, let's use libmd which has the
same API instead.
In order to avoid the collision in definitions (sha256.h cannot be
included in the same file as a file where openssl headers has been
included) let's move the sha256 related code in its own file
PR: 270023
Reported by: ngie
Add an internal debug level global:
- Level 1 (-d) currently does nothing.
- Level 2 (-d -d) enables libfetch debugging (quite verbose) so it's
possible to see what pkg is attempting to download without having
to sniff traffic.
Reviewed by: debdrup, bapt
Differential Revision: https://reviews.freebsd.org/D35756
Colin Percival