Like under an average Linux distribution - are there any checkings that the downloaded packages are really the packages that are on the mirror server?
asked Sep 8, 2011 at 13:42
Add a comment
|
2 Answers
Packages fetched by pkg_add from the official mirror sites are signed and the pkg_add utility will automatically check the signatures against the keys available on your system.
From the pkg_add manual:
If a package is digitally signed:
• pkg_add checks that its signature is valid and that the signature was
emitted by a valid signing key, as stored in /etc/signify/*-pkg.pub,
• pkg_add verifies that the compressed package data matches the
signature, before it decompresses and unpacks files.
The signatures are not checked using GnuPG but with the native signify utility.
Old (outdated) answer from 2011:
No, there are not. But see these threads from the openbsd-misc list:
answered Sep 8, 2011 at 13:54
Now you can perform some checks, when you update the system!
Check the signify command mentioned here:
https://www.openbsd.org/faq/faq4.html#Download
You can get the SHA256.sig file from the official mirror, under your version and architecture.
When you update, you need to check the new version's kernel signatures before booting it (and selecting (U)pgrade). After that, the updater does signature checking automatically for the rest of the system it installs.
