2

Like under an average Linux distribution - are there any checkings that the downloaded packages are really the packages that are on the mirror server?

2 Answers 2

5

Packages fetched by pkg_add from the official mirror sites are signed and the pkg_add utility will automatically check the signatures against the keys available on your system.

From the pkg_add manual:

 If a package is digitally signed:

 •   pkg_add checks that its signature is valid and that the signature was
     emitted by a valid signing key, as stored in /etc/signify/*-pkg.pub,

 •   pkg_add verifies that the compressed package data matches the
     signature, before it decompresses and unpacks files.

The signatures are not checked using GnuPG but with the native signify utility.


Old (outdated) answer from 2011:

No, there are not. But see these threads from the openbsd-misc list:

0
0

Now you can perform some checks, when you update the system! Check the signify command mentioned here: https://www.openbsd.org/faq/faq4.html#Download

You can get the SHA256.sig file from the official mirror, under your version and architecture.

When you update, you need to check the new version's kernel signatures before booting it (and selecting (U)pgrade). After that, the updater does signature checking automatically for the rest of the system it installs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .