Like under an average Linux distribution - are there any checkings that the downloaded packages are really the packages that are on the mirror server?
2 Answers
Packages fetched by pkg_add
from the official mirror sites are signed and the pkg_add
utility will automatically check the signatures against the keys available on your system.
From the pkg_add
manual:
If a package is digitally signed:
• pkg_add checks that its signature is valid and that the signature was
emitted by a valid signing key, as stored in /etc/signify/*-pkg.pub,
• pkg_add verifies that the compressed package data matches the
signature, before it decompresses and unpacks files.
The signatures are not checked using GnuPG but with the native signify
utility.
Old (outdated) answer from 2011:
No, there are not. But see these threads from the openbsd-misc list:
Now you can perform some checks, when you update the system!
Check the signify
command mentioned here:
https://www.openbsd.org/faq/faq4.html#Download
You can get the SHA256.sig file from the official mirror, under your version and architecture.
When you update, you need to check the new version's kernel signatures before booting it (and selecting (U)pgrade
). After that, the updater does signature checking automatically for the rest of the system it installs.