I just install NetBSD in from ISO image inside VirtualBox.

Official source ISO media contains only MD5/SHA512 sums.

Similarly pkg_add binary packag repository contains only SHA512 sums.

Both FTP and HTTP distribution channels is unsecured and check sums file transfer may be altered.

Is digital signature used by NetBSD project?

How enforce checks for package integrity when pkg_add is used?


A PGP-signed list of hashes is available, covering all the release files. The PGP key used to sign this is well connected in the web of trust.

  • Thanks for answer! Does pkg_add aware about PGP keys? Where is trusted store located on local machine? I set PKG_PATH env var but can't figure out how I should accept signing keys... – gavenkoa May 19 '16 at 21:48
  • I can't find any signatures for NetBSD packages; there's a the list of SHA-512 hashes but it isn't signed. – Stephen Kitt May 20 '16 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.