FreeBSD Manual Pages
PKG-KEY(8) System Manager's Manual PKG-KEY(8) NAME pkg key -- signing key operations SYNOPSIS pkg key [--create | --public | --sign] [-t type] keyfile DESCRIPTION pkg key is used to create or extract signing keys for use with pkg-repo(8). Cryptographically signing your package repository catalogue is strongly recommended. If none of the --create, --public, or --sign operations are specified, pkg key displays information about the keyfile on stdout. See pkg-repo for some practical examples of using pkg key. OPTIONS The following options are supported by pkg key: --create Create the named key. Note that any file at keyfile will be overwrit- ten. pkg key will chmod(2) the keyfile to 0400 upon successful com- pletion. The corresponding public key will be written to stdout, note the caveats of this described with the --public option. The -t option should be used when generating keys to be explicit about the type of key requested. Note that the ecdsa and eddsa keys generated by pkg key are not com- patible with those generated by OpenSSL, but pkg(8) can read ecdsa keys generated by OpenSSL. --public Write the public key corresponding to keyfile out to stdout. Note that some signers may output keys in a binary format, so it is recom- mended to redirect stdout to a file. --sign Signs the data ingested via stdin with the named keyfile, and writes the signature data to stdout. As with --public, note that the signa- ture may be a binary format and it is recommended to redirect stdout to a file. -t type Specifies the type of signer to use for the given key. pkg key will not try to guess the correct signer that goes with a key in any case, so it must be specified for every operation. The rsa signer is as- sumed if -t is not specified. The following signers are currently supported: rsa Backend using RSA with keys created either by OpenSSL or by pkg key --create. ecc An alias for the eddsa signer. ecdsa Backend using ECDSA with keys created either by OpenSSL or by pkg key --create. See "Elliptic Curve Cryptography" for more discus- sion. eddsa Backend using EdDSA with keys created by pkg key --create. See "Elliptic Curve Cryptography" for more discussion. Elliptic Curve Cryptography Elliptic Curve Cryptography, ECC, is supported by pkg(8), with limited com- patibility with OpenSSL. Signatures are output in a format that OpenSSL can handle, subject to the constraints about curve choice outlined in the rest of this section. The ecdsa signer is expected to be interoperable with OpenSSL, but curve choice is more limited than what OpenSSL provides. In general, the curves provided must be supported both by OpenSSL and by the libecc used by pkg(8). The criteria for curve selection is that they must be 256-bit or higher and accepted by both implementations. The following common curves are currently supported: * secp256k1 * secp384r1 * secp521r1 * brainpoolP256r1 * brainpoolP256t1 * brainpoolP320r1 * brainpoolP320t1 * brainpoolP384r1 * brainpoolP384t1 * brainpoolP512r1 * brainpoolP512t1 The eddsa signer is not compatible with OpenSSL due to limited curve selec- tion provided by libecc by default. The only curve supported by pkg(8) for EdDSA is WEI25519. FILES See pkg.conf(5). SEE ALSO pkg_checksum(3), pkg_create(3), pkg_printf(3), pkg_repo_create(3), pkg_re- pos(3), pkg-keywords(5), pkg-lua-script(5), pkg-repository(5), pkg- script(5), pkg-triggers(5), pkg.conf(5), pkg(8), pkg-add(8), pkg-alias(8), pkg-annotate(8), pkg-audit(8), pkg-autoremove(8), pkg-check(8), pkg-check- sum(8), pkg-clean(8), pkg-config(8), pkg-create(8), pkg-delete(8), pkg- fetch(8), pkg-help(8), pkg-info(8), pkg-install(8), pkg-lock(8), pkg-plug- ins(8), pkg-query(8), pkg-register(8), pkg-repo(8), pkg-repositories(8), pkg-rquery(8), pkg-rwhich(8), pkg-search(8), pkg-set(8), pkg-shell(8), pkg- shlib(8), pkg-ssh(8), pkg-stats(8), pkg-triggers(8), pkg-unregister(8), pkg-update(8), pkg-updating(8), pkg-upgrade(8), pkg-version(8), pkg- which(8) FreeBSD ports 15.quarterly March 6, 2024 PKG-KEY(8)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | FILES | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=pkg-key&sektion=8&manpath=FreeBSD+Ports+15.1.quarterly>