PKG-REPO(8)

📦 version 2.7.5, in nixos 26.05, nixpkgs unstable

🌸 PKG-REPO(8) 🌸 — the System Manager's Manual page, bestie edition 💅

okay so. listen. this is pkg repo — the create a package repository catalogue girlie. she's from the System Manager's Manual, she's iconic, and she's about to make your repo actually shareable. no cap. 🎀

✨ SYNOPSIS ✨

pkg repo [-hlqs] [-g groups] [-m meta-file] [-o output-dir] ⟨repo-path⟩
    [signer-type:⟨keyfile⟩ | signing_command: ⟨the command⟩]

pkg repo [--{hash,list-files,quiet,symlink}] [--groups groups]
    [--meta-file meta-file] [--output-dir output-dir] ⟨repo-path⟩
    [signer-type:⟨keyfile⟩ | signing_command: ⟨the command⟩]

like, that's the whole vibe up there. both forms, same energy. 💖

💜 DESCRIPTION 💜

pkg repo is literally the tool you use to create a catalogue of the available packages in a repository. that's it, that's the job. and bestie, these catalogues are necessary for sharing your package repository — they're intrinsic to how pkg install or pkg upgrade even function. like, no catalogue, no install. periodt. 🔥

The current repository format is version 2. The repository files that pkg repo creates consist of:

  • a UCL metadata file, and
  • a set of compressed .pkg archives stored at the top level of the repository filesystem.

so let's meet the cast 👑

🦋 the files it makes

  • meta.conf — a plain-text UCL file that must exist at the apex of the repository filesystem. It describes the repository version, the compression format, and the names of the catalogue archives. See pkg-repository(5) for a detailed description of its fields.
  • packagesite.pkg — a deprecated compressed archive containing packagesite.yaml, which lists the metadata for each of the packages in the repository. Each package manifest is represented as a single-line compact JSON text, with manifests separated by newlines. It's still generated for backward compatibility, but heads up: it is superseded by data.pkg. 💀 (still here, still doing its thing, but like... her time has passed)
  • data.pkg — the primary catalogue archive, main character energy fr. It contains a JSON file with package manifests, package group definitions, and expired package entries. See pkg-repository(5) for details.
  • filesite.pkg — an optional compressed archive containing filesite.yaml, a database of all files present in all packages in the repository. It is only generated when the -l flag is used. (optional queen 🌸)

The compressed archives may also contain cryptographic signatures when the signing mechanism of pkg repo is enabled. ✨

Repository users download these files to their local machines, where they are processed into per-repository sqlite databases for fast lookup of available packages by programs such as pkg-install(8). so like, the whole point is speed later. iykyk.

🧚 how to actually run it

To create a package repository catalogue, specify the top-level directory beneath which all the packages are stored as repo-path. pkg repo will search the filesystem beneath repo-path to find all .pkg files it contains. Directories starting with . or named Latest are not traversed — so don't hide your packages in there and then act surprised, bestie. 🙈

The repository files will be created in the top-level repository directory unless relocated by specifying -o output-dir or --output-dir output-dir.

🔐 signing (the important part, lowkey)

Optionally, the repository catalogue may be cryptographically signed. This is enabled either by:

  • specifying the path to a private key as the keyfile argument, or
  • using an external command.

When a keyfile is being used, it may be prefixed by the signer type. Currently, this may be one of rsa, ecdsa, or eddsa. ecc is also accepted as an alias of eddsa. Keys for the rsa and ecdsa signers may be generated by OpenSSL or by pkg-key(8). Keys for the "eddsa" signer may only be generated by pkg-key(8). that's the rule, don't fight it. 💅

If the key is used, a hash of the repository is signed using the provided key. The rsa signer will sign the SHA256 hash of the repository, while the ecdsa and eddsa signers will sign the BLAKE2 hash of the repository. The signature is added into the repository catalogue. The client side should use SIGNATURE_TYPE set to PUBKEY and PUBKEY set to a local path of the public key in its repository configuration file.

🖥️ external signing commands

An external command can be useful to create a signing server to keep the private key separate from the repository. The external command is passed the SHA256 of the repository catalogue on its stdin. It should output the following format:

TYPE
signer type here (rsa, ecdsa, eddsa)
SIGNATURE
signature data here
CERT
public key data here
END

The TYPE field is optional if using rsa, to remain compatible with external signing commands historically in use. Note that the SIGNATURE field's data will may require an extra newline after it if the signature is output in a binary format. The CERT field may contain binary data, but pkg(8) will search the tail of it for the missing END if it runs together. (yes, that "will may" is in the original, we don't edit the queen's grammar 😭)

When using an external command, the client's pkg.conf must have SIGNATURE_TYPE set to FINGERPRINTS and FINGERPRINTS set to a directory having a trusted/myrepo containing a fingerprint style representation of the public key:

function: sha256
fingerprint: \"sha256_representation_of_the_public_key\"

See the "EXAMPLES" section and pkg.conf(5) for more information.

🫶 Signing the catalogue is strongly recommended. like, please. do it. for me.

💅 OPTIONS 💅

The following options are supported by pkg repo:

  • -g groups, --groups groups — Set the group ownership of the repository files to groups.
  • -h, --hash — Append a short hash of the package contents to the package filename. This is the same as setting the PKG_REPO_HASH environment variable.
  • -l, --list-files — Generate list of all files in repo as filesite.pkg archive.
  • -m meta-file, --meta-file meta-file — Use the specified file as repository meta file instead of the default settings.
  • -o output-dir, --output-dir output-dir — Create the repository in the specified directory instead of the package directory.
  • -q, --quiet — Force quiet output. (shhh 🤫)
  • -s, --symlink — Create a symlink between the hashed filename and the regular filename. Only useful in combination with -h. This is the same as setting the PKG_REPO_SYMLINK environment variable.

🎀 FILES 🎀

See pkg.conf(5). that's the whole section, she's brief and mysterious 💜

🌈 ENVIRONMENT 🌈

  • PKG_REPO_HASH — When set, rename packages with the short hash of contents appended to the filename.
  • PKG_REPO_SYMLINK — When set, create a symlink between the short hash filename and the regular filename.

⭐ SEE ALSO ⭐

pkg_create(3), pkg_printf(3), pkg_repo_create(3), pkg_repos(3), pkg-keywords(5), pkg-lua-script(5), pkg-repository(5), pkg-script(5), pkg-triggers(5), pkg.conf(5), pkg(8), pkg-add(8), pkg-alias(8), pkg-annotate(8), pkg-audit(8), pkg-autoremove(8), pkg-check(8), pkg-clean(8), pkg-config(8), pkg-create(8), pkg-delete(8), pkg-fetch(8), pkg-help(8), pkg-info(8), pkg-install(8), pkg-key(8), pkg-lock(8), pkg-plugins(8), pkg-query(8), pkg-register(8), pkg-repositories(8), pkg-rquery(8), pkg-search(8), pkg-set(8), pkg-shell(8), pkg-shlib(8), pkg-ssh(8), pkg-stats(8), pkg-triggers(8), pkg-unregister(8), pkg-update(8), pkg-updating(8), pkg-upgrade(8), pkg-version(8), pkg-which(8)

like, that's a whole friend group. go say hi. 🫶

🔥 EXAMPLES 🔥

create an RSA key pair

% openssl genrsa -out repo.key 2048
% chmod 0400 repo.key
% openssl rsa -in repo.key -out repo.pub -pubout

create a repository and sign it with a local RSA key

The public key would be shared on all client servers with SIGNATURE_TYPE set to PUBKEY and its path set via PUBKEY setting in the repository configuration file:

pkg repo /usr/ports/packages repo.key

create a repository and sign it with an external command

The client should set, via the repository configuration file, SIGNATURE_TYPE to FINGERPRINTS and FINGERPRINTS to a path containing a file with the SHA256 of the public key:

# On signing server:
% cat > sign.sh << EOF
#!/bin/sh
read -t 2 sum
[ -z "$sum" ] && exit 1
echo SIGNATURE
echo -n $sum | /usr/bin/openssl dgst -sign repo.key -sha256 -binary
echo
echo CERT
cat repo.pub
echo END
EOF

# On package server:
% pkg repo /usr/ports/packages signing_command: ssh signing-server sign.sh
# Generate fingerprint for sharing with clients
% sh -c '( echo "function: sha256"; echo "fingerprint: \"$(sha256 -q repo.pub)\""; ) > fingerprint'
# The 'fingerprint' file should be distributed to all clients.

# On clients with FINGERPRINTS: /usr/local/etc/pkg/fingerprints/myrepo:
$ mkdir -p /usr/local/etc/pkg/fingerprints/myrepo/trusted
# Add 'fingerprint' into /usr/local/etc/pkg/fingerprints/myrepo/trusted

the ECDSA glow-up

The above examples can be repeated with OpenSSL creating a key pair for ECDSA:

% openssl ecparam -genkey -name secp256k1 -out repo.key -outform DER
% chmod 0400 repo.key
% openssl ec -in repo.key -out repo.pub -pubout -outform DER

Prefixing the later repo.key reference with "ecdsa":

pkg repo /usr/ports/packages ecdsa:repo.key

The signing server example can be used mostly as-is, but with the following text placed before the SIGNATURE section in the signing server output:

TYPE
ecdsa

EdDSA time 🧚

For EdDSA instead, create an EdDSA key pair:

% pkg key --create -t eddsa repo.key > repo.pub

Create a repository and sign it with a local key. As with the RSA example above, the public key would be shared on all client servers with SIGNATURE_TYPE set to PUBKEY and its path set via PUBKEY option in the repository configuration file:

pkg repo /usr/ports/packages eddsa:repo.key

A signing server for EdDSA could be constructed with the --sign option. 💅

💀 one last vibe check: packagesite.pkg is deprecated, -s/PKG_REPO_SYMLINK only does anything with -h/PKG_REPO_HASH, and eddsa keys come from pkg-key(8) and nowhere else. remember those and you're golden. ✨

and that's the page, bestie! 🎀 this one's from Debian, dated January 17, 2021 — so like, a little vintage, but she still ate. 💖 mwah. 🫶

📦 where this page comes from