PKG-KEY(8)

💖 NAME 💖

okay so pkg key — it's the signing key operations girlie, that's the whole vibe. And yes the manual is PKG-KEY(8), system manager's manual, we're fancy like that 💅

---

✨ SYNOPSIS ✨

pkg key [--create | --public | --sign] [-t type] keyfile

---

🦋 DESCRIPTION 🦋

So pkg key is literally the tool you use to create or extract signing keys for use with pkg-repo(8). and bestie, listen — cryptographically signing your package repository catalogue is strongly recommended. not like "oh maybe if you have time" recommended, like strongly. do it. 🔥

If you don't specify any of the --create, --public, or --sign operations? Then pkg key just displays info about the keyfile, out to stdout. casual lil info dump, no notes 💅

Also — go check pkg-repo for some practical examples of using pkg key, because examples >>> everything. iykyk 🫶

---

🎀 OPTIONS 🎀

here's everything pkg key supports, no gatekeeping:

• --create — creates the named key. ⚠️ heads up: any file at keyfile will be overwritten. that's not a drill. On successful completion, pkg key will chmod(2) the keyfile to 0400, so it's locked down, we love a secure queen 👑. The corresponding public key gets written to stdout — but peep the caveats described with the --public option, they apply here too. And the -t option should be used when generating keys so you're being explicit about the type of key requested. be explicit, it's a vibe.

Also, important, no cap: the ecdsa and eddsa keys generated by pkg key are not compatible with those generated by OpenSSL. But pkg(8) can read ecdsa keys generated by OpenSSL. so it's giving one-way friendship 😭

• --public — writes the public key corresponding to keyfile out to stdout. note that some signers may output keys in a binary format, so it's recommended to redirect stdout to a file. don't just let binary goo splash on your terminal, redirect it 🫶
• --sign — signs the data ingested via stdin with the named keyfile, and writes the signature data to stdout. Same energy as --public: the signature may be a binary format, so redirect stdout to a file. fr fr, redirect it 💀
• -t type — specifies the type of signer to use for the given key. And listen: pkg key will not try to guess the correct signer that goes with a key. in any case. so it must be specified for every operation, periodt. If -t isn't specified, the rsa signer is assumed. Here are the currently supported signers:
  • rsa — backend using RSA with keys created either by OpenSSL or by pkg key --create. classic, reliable, main character energy ⭐
  • ecc — an alias for the eddsa signer. that's it, that's the whole thing.
  • ecdsa — backend using ECDSA with keys created either by OpenSSL or by pkg key --create. see "Elliptic Curve Cryptography" below for more discussion 🌈
  • eddsa — backend using EdDSA with keys created by pkg key --create. see "Elliptic Curve Cryptography" below for more discussion 🌈

🌸 Elliptic Curve Cryptography 🌸

Elliptic Curve Cryptography — ECC — is supported by pkg(8), with limited compatibility with OpenSSL. Signatures are output in a format that OpenSSL can handle, subject to the constraints about curve choice outlined in the rest of this here section. so read on, bestie 🧚

The ecdsa signer is expected to be interoperable with OpenSSL, but curve choice is more limited than what OpenSSL provides. In general, the curves provided must be supported both by OpenSSL and by the library libecc used by pkg(8). The criteria for curve selection? They must be 256-bit or higher and accepted by both implementations. The following common curves are currently supported:

• secp256k1
• secp384r1
• secp521r1
• brainpoolP256r1
• brainpoolP256t1
• brainpoolP320r1
• brainpoolP320t1
• brainpoolP384r1
• brainpoolP384t1
• brainpoolP512r1
• brainpoolP512t1

The eddsa signer is not compatible with OpenSSL, due to limited curve selection provided by library libecc by default. 😭 The only curve supported by pkg(8) for EdDSA is WEI25519. that's the one. the solo icon.

---

🍓 FILES 🍓

See pkg.conf(5). that's the whole section, she's short and mysterious 💜

---

💫 SEE ALSO 💫

okay this is the whole friend group, say hi to everybody:

pkg_create(3), pkg_printf(3), pkg_repo_create(3), pkg_repos(3), pkg-keywords(5), pkg-lua-script(5), pkg-repository(5), pkg-script(5), pkg-triggers(5), pkg.conf(5), pkg(8), pkg-add(8), pkg-alias(8), pkg-annotate(8), pkg-audit(8), pkg-autoremove(8), pkg-check(8), pkg-clean(8), pkg-config(8), pkg-create(8), pkg-delete(8), pkg-fetch(8), pkg-help(8), pkg-info(8), pkg-install(8), pkg-lock(8), pkg-plugins(8), pkg-query(8), pkg-register(8), pkg-repo(8), pkg-repositories(8), pkg-rquery(8), pkg-search(8), pkg-set(8), pkg-shell(8), pkg-shlib(8), pkg-ssh(8), pkg-stats(8), pkg-triggers(8), pkg-unregister(8), pkg-update(8), pkg-updating(8), pkg-upgrade(8), pkg-version(8), pkg-which(8)

---

and that's the page, bestie 🫶 this one's from Debian, dated March 6, 2024 — go sign your repos, stay iconic, and remember: redirect that stdout 💅✨