Are there any GPG checks in OpenBSD when installing an application?

Question

Like under an average Linux distribution - are there any checkings that the downloaded packages are really the packages that are on the mirror server?

Answer 1

Packages fetched by pkg_add from the official mirror sites are signed and the pkg_add utility will automatically check the signatures against the keys available on your system.

From the pkg_add manual:

 If a package is digitally signed:

 •   pkg_add checks that its signature is valid and that the signature was
     emitted by a valid signing key, as stored in /etc/signify/*-pkg.pub,

 •   pkg_add verifies that the compressed package data matches the
     signature, before it decompresses and unpacks files.

The signatures are not checked using GnuPG but with the native signify utility.

---

Old (outdated) answer from 2011:

No, there are not. But see these threads from the openbsd-misc list:

• package integrity, security and checks. .... where are they ?
• package and port paranoia

Answer 2

Now you can perform some checks, when you update the system! Check the signify command mentioned here: https://www.openbsd.org/faq/faq4.html#Download

You can get the SHA256.sig file from the official mirror, under your version and architecture.

When you update, you need to check the new version's kernel signatures before booting it (and selecting (U)pgrade). After that, the updater does signature checking automatically for the rest of the system it installs.