From 695a66684a0536e38b489993eaf395a899875a2e Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 28 Mar 2026 13:19:07 +0200 Subject: Sign OpenBSD packages with signify, drop -D unsigned Packages are now signed via pkg_sign with the custom-pkg signify key on the OpenBSD build host. The public key at /etc/signify/custom-pkg.pub on each client allows pkg_add to verify without -D unsigned. Co-Authored-By: Claude Opus 4.6 --- frontends/Rexfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'frontends/Rexfile') diff --git a/frontends/Rexfile b/frontends/Rexfile index 0b508a9..add480e 100644 --- a/frontends/Rexfile +++ b/frontends/Rexfile @@ -506,8 +506,8 @@ task 'dtail', desc 'Installing Gogios binary'; # Configure the custom package repository on OpenBSD frontends. # Adds PKG_PATH to root's .profile so custom packages are available -# alongside the official OpenBSD repo. Official packages still install -# normally; custom (unsigned) packages require -D unsigned. +# alongside the official OpenBSD repo. Packages are signed with signify; +# the public key must be at /etc/signify/custom-pkg.pub on each host. desc 'Setup custom package repo on OpenBSD frontends'; task 'pkgrepo_setup', group => 'frontends', @@ -534,8 +534,8 @@ task 'gogios_install', run 'rm -f /usr/local/bin/gogios'; } - # Install or update from custom repo (unsigned for now) - say run 'PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -D unsigned -u gogios || PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -D unsigned gogios'; + # Install or update from custom repo (packages signed with signify) + say run 'PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add -u gogios || PKG_PATH="https://pkgrepo.f3s.buetow.org/openbsd/7.8/packages/amd64/" pkg_add gogios'; } elsif ( $os eq 'FreeBSD' ) { say run 'pkg update -r custom && pkg install -y gogios'; -- cgit v1.2.3