1pkgadm(1M) System Administration Commands pkgadm(1M)
2
6 pkgadm - manage packaging and patching system
7
9 pkgadm addcert [-ty] [-a app] [-k keystore] [-e keyfile]
10 [-f format] [-n name] [-P passarg]
11 [-p import_passarg] [-R rootpath] certfile
12 pkgadm removecert [-a app] [-k keystore] -n name
15 [-P passarg] [-R rootpath]
16 pkgadm listcert [-a app] [-f format] [-k keystore] -n name
19 [-P passarg] [-o outfile] [-R rootpath]
20 pkgadm dbstatus [-R rootpath]
23 pkgadm sync [-R rootpath] [-q]
26 pkgadm -V
29 pkgadm -?
32
35 The pkgadm utility is used for managing the packaging and patching sys‐
36 tem. It has several subcommands that perform various operations relat‐
37 ing to packaging. The pkgadm command includes subcommands for managing
38 certificates and keys used.
39 Managing Keys and Certificates
41 pkgadm maintains the packaging-system-wide keystore in /var/sadm/secu‐
42 rity, and individual user's certificates in ~/.pkg/security. The fol‐
43 lowing subcommands operate on the package keystore database:
44 addcert
46 Add (import) a certificate into the database, with optional trust.
48 Once added, trusted certificates can be used to verify signed pack‐
49 ages and patches. Non-trusted user certificates and their associ‐
50 ated keys can be used to sign packages and patches. Added user cer‐
51 tificates are not used to build certificate chains during certifi‐
52 cate verification.
53 removecert
56 Removes a user certificate/private key pair, or a trusted certifi‐
58 cate authority certificate from the keystore. Once removed, the
59 certificate and keys cannot be used.
60 listcert
63 Print details of one or more certificates in the keystore.
65 sync
68 Writes the contents file and rolls the contents log file. With use
70 of the -q option, forces the contents file server to quit.
71 Internal Install Database
74 The Solaris operating system relies upon enhanced System V revision 4
75 (SVr4) packages as the basis for its software installation and revision
76 management. The package maintenance software stores information about
77 installed packages in an internal database. The pkgadm subcomand dbsta‐
78 tus is used to determine how the package internal database is imple‐
79 mented. The dbstatus command returns a string that indicates the type
80 of internal database in use. In the current implementation, the dbsta‐
81 tus command always returns the string text, which indicates that the
82 contents(4) package database is inuse. Future releases of Solaris might
83 supply alternative database implementations.
84
86 The following options are supported:
87 -a app
89 If this option is used, then the command only affects the keystore
91 associated with a particular application. Otherwise, the global
92 keystore is affected.
93 -e keyfile
96 When adding a non-trusted certificate/key combination, this option
98 can be used to specify the file that contains the private key. If
99 this option is not used, the private key must be in the same file
100 as the certificate being added.
101 -f format
104 When adding certificates, this specifies the format to expect cer‐
106 tificates and private keys in. Possible values when adding are:
107 pem
109 Certificate and any private key uses PEM encoding.
111 der
114 Certificate and any private key uses DER encoding.
116 When printing certificates, this specifies the output format used
118 when printing. Acceptable values for format are:
119 pem
121 Output each certificate using PEM encoding.
123 der
126 Output each certificate using DER encoding.
128 text
131 Output each certificate in human-readable format.
133 -k keystore
137 Overrides the default location used when accessing the keystore.
139 -n name
142 Identifies the entity in the store on which you want to operate.
144 When adding a user certificate, or removing certificates, this name
145 is required. The name is associated with the certificate/key combi‐
146 nation, and when adding, can be used later to reference the entity.
147 When printing certificates, if no alias is supplied, then all key‐
148 store entities are printed.
149 -o outfile
152 Output the result of the command to outfile. Only used when examin‐
154 ing (printing) certificates from the key store. Standard out is the
155 default.
156 -P passarg
159 Password retrieval method to use to decrypt keystore specified with
161 -k, if required. See PASS PHRASE ARGUMENTS in pkgadd(1M) for more
162 information about the format of this option's argument. console is
163 the default.
164 -p import_passarg
167 This option's argument is identical to -P, but is used for supply‐
169 ing the password used to decrypt the certificate and/or private key
170 being added. console is the default.
171 -q
174 (Applies to sync subcommand.) Shuts down the contents file cache
176 daemon.
177 -R rootpath
180 Defines the full name of a directory to use as the root (/) path.
182 The default user location of the certificate operations is
183 ${HOME}/.pkg. If the -R option is supplied, the certificates and
184 keys will be stored under <altroot>/var/sadm/security. Note that
185 this operation fails if the user does not have sufficient permis‐
186 sions to access this directory. The listcert command requires read
187 permission, while addcert and removecert require both read and
188 write permission.
189 Note -
191 The root file system of any non-global zones must not be refer‐
193 enced with the -R option. Doing so might damage the global zone's
194 file system, might compromise the security of the global zone,
195 and might damage the non-global zone's file system. See zones(5).
196 -t
199 Indicates the certificate being added is a trusted CA certificate.
201 The details of the certificate (including the Subject Name, Valid‐
202 ity Dates, and Fingerprints) are printed and the user is asked to
203 verify the data. This verification step can be skipped with -y.
204 When importing a trusted certificate, a private key should not be
205 supplied, and will be rejected if supplied. Once a certificate is
206 trusted, it can be used as a trust anchor when verifying future
207 untrusted certificates.
208 -V
211 Print version associated with packaging tools.
213 -y
216 When adding a trusted certificate, the details of the certificate
218 (Subject name, Issuer name, Validity dates, Fingerprints) are shown
219 to the user and the user is asked to verify the correctness before
220 proceeding. With -y, this additional verification step is skipped.
221 -?
224 Print help message.
226
229 The following operand is supported:
230 certfile
232 File containing the certificate and optional private key, used when
234 adding a trust anchor or certificate/key combination. Certificates
235 must be encoded using PEM or binary DER.
236
239 All keystore entries (user cert/key and trusted certificate entries)
240 are accessed via unique aliases. Aliases are case-sensitive.
241 An alias is specified when you add an entity to a keystore using the
244 addcert or trustcert subcommand. If an alias is not supplied for a
245 trust anchor, the trust anchor's Common Name is used as the alias. An
246 alias is required when adding a signing certificate or chain certifi‐
247 cate. Subsequent pkgcert or other package tool commands must use this
248 same alias to refer to the entity.
249
251 See the pkgadd(1M) man page for a description of the passwords supplied
252 to the pkgadm utility.
253
255 Example 1 Adding a Trust Anchor
256 The following example adds a well-known and trusted certificate to be
259 used when verifying signatures on packages.
260 example% pkgadm addcert -t /tmp/certfile.pem
263 Example 2 Adding a Signing Certificate
267 The following example adds a signing certificate and associated private
270 key, each of which is in a separate file, which can then be used to
271 sign packages.
272 example% pkgadm addcert -a pkgtrans -e /tmp/keyfile.pem \
275 /tmp/certfile.pem
276 Example 3 Printing Certificates
280 The following example prints all certificates in the root keystore.
283 example% pkgadm listcert
286
290 0
291 successful completion
293 non-zero
296 fatal error
298
301 See attributes(5) for descriptions of the following attributes:
302 ┌─────────────────────────────┬─────────────────────────────┐
307 │ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
308 ├─────────────────────────────┼─────────────────────────────┤
309 │Availability │SUNWpkgcmdsu │
310 ├─────────────────────────────┼─────────────────────────────┤
311 │Interface Stability │Evolving │
312 └─────────────────────────────┴─────────────────────────────┘
313
315 pkginfo(1), pkgmk(1), pkgparam(1), pkgproto(1), pkgtrans(1), svcs(1),
316 installf(1M), pkgadd(1M), pkgask(1M), pkgrm(1M), removef(1M),
317 svcadm(1M), admin(4), contents(4), exec_attr(4), pkginfo(4),
318 attributes(5), rbac(5), smf(5)
319
324 The service for pkgadm is managed by the service management facility,
325 smf(5), under the service identifier:
326 svc:/system/pkgserv
328 Administrative actions on this service, such as enabling, disabling, or
333 requesting restart, can be performed using svcadm(1M). The service's
334 status can be queried using the svcs(1) command.
335SunOS 5.11 20 Mar 2009 pkgadm(1M)