Verification of packages

olijens

Hi, I was wondering if the pkg utility did some kind of verification on the authenticity of the package when downloading it from the net? Some kind of checksum or something like that.
And if so, is it possible to do that manually if I download the package from netgates webpages?

Gertjan

@olijens

pfSEnse is based on Freebsd 12.2 Stable. It inherents the package = pkg system used by this OS. Knowing that, you know the answer as it is very documented.

Have a look at the pfSense pkg configuration file :


pfSense-core: {
  url: "pkg+https://packages.netgate.com/pfSense_v2_5_2_amd64-core",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

pfSense: {
  url: "pkg+https://packages.netgate.com/pfSense_v2_5_2_amd64-pfSense_v2_5_2",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

The fingerprints are used to make sure that file came over intact.
The downloaded package file also works with checksums (see the man page).

@olijens said in Verification of packages:

s it possible to do that manually if I download the package from netgates webpages?

Not that I know of.
There isn't really a way to install these manually, anyway.
Downloaded package are stored here : /var/cache/pkg/

olijens

@gertjan Well, this forum post indicates that it is possible to install packages while offline. I think 'pkg add' will do the trick after uploading the package to the pfSense system.

But thanks for clarifying for me about the fingerprints.