[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-15:18.pkg

FreeBSD Errata Notices errata-notices at freebsd.org
Wed Sep 16 21:31:41 UTC 2015

Hash: SHA512

FreeBSD-EN-15:18.pkg                                            Errata Notice
                                                          The FreeBSD Project

Topic:          Implement pubkey support for pkg(7) bootstrap

Category:       core
Module:         pkg
Announced:      2015-09-16
Credits:        Baptiste Daroussin
Affects:        All supported versions of FreeBSD.
Corrected:      2015-09-15 05:56:16 UTC (stable/10, 10.2-STABLE)
                2015-09-16 20:59:41 UTC (releng/10.2, 10.2-RELEASE-p3)
                2015-09-16 21:00:21 UTC (releng/10.1, 10.1-RELEASE-p20)
                2015-09-15 08:34:32 UTC (stable/9, 9.3-STABLE)
                2015-09-16 21:00:21 UTC (releng/9.3, 9.3-RELEASE-p26)

For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit

I.   Background

The pkg(8) utility is the package management tool for FreeBSD.  The base
system includes a pkg(7) bootstrap utility used to install the latest
pkg(8) utility.

II.  Problem Description

The pubkey method is not supported by the pkg(7) bootstrap utility.
Previously, before EN-15:15.pkg, if the system administrator requested
this method, it is silently ignored and no check is performed.

In EN-15:15.pkg, pkg(7) have been modified to issue warning and refuse
to proceed any further.

III. Impact

There is no way to use the pubkey method to bootstrap pkg(8) on the

IV.  Workaround

No workaround is available, but the default FreeBSD configuration is not
affected because it uses "fingerprint" method.

V.   Solution

Perform one of the following:

1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.

2) To update your present system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

3) To update your present system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 10.x]
# fetch https://security.FreeBSD.org/patches/EN-15:18/pkg-10.patch
# fetch https://security.FreeBSD.org/patches/EN-15:18/pkg-10.patch.asc
# gpg --verify pkg-10.patch.asc

[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/EN-15:18/pkg-9.patch
# fetch https://security.FreeBSD.org/patches/EN-15:18/pkg-9.patch.asc
# gpg --verify pkg-9.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/9/                                                         r287814
releng/9.3/                                                       r287873
stable/10/                                                        r287810
releng/10.1/                                                      r287873
releng/10.2/                                                      r287872
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:


VII. References

The latest revision of this Errata Notice is available at

Version: GnuPG v2.1.8 (FreeBSD)


More information about the freebsd-announce mailing list