pkgadm(1M) System Administration Commands pkgadm(1M)NAMEpkgadm - manage packaging and patching system
SYNOPSISpkgadm addcert [-ty] [-a app] [-k keystore] [-e keyfile]
[-f format] [-n name] [-P passarg]
[-p import_passarg] [-R rootpath] certfile
pkgadm removecert [-a app] [-k keystore] -n name
[-P passarg] [-R rootpath]
pkgadm listcert [-a app] [-f format] [-k keystore] -n name
[-P passarg] [-o outfile] [-R rootpath]
pkgadm dbstatus [-R rootpath]
pkgadm sync [-R rootpath] [-q]
pkgadm-V
pkgadm -?
DESCRIPTION
The pkgadm utility is used for managing the packaging and patching sys‐
tem. It has several subcommands that perform various operations relat‐
ing to packaging. The pkgadm command includes subcommands for managing
certificates and keys used.
Managing Keys and Certificates
pkgadm maintains the packaging-system-wide keystore in /var/sadm/secu‐
rity, and individual user's certificates in ~/.pkg/security. The fol‐
lowing subcommands operate on the package keystore database:
addcert
Add (import) a certificate into the database, with optional trust.
Once added, trusted certificates can be used to verify signed pack‐
ages and patches. Non-trusted user certificates and their associ‐
ated keys can be used to sign packages and patches. Added user cer‐
tificates are not used to build certificate chains during certifi‐
cate verification.
removecert
Removes a user certificate/private key pair, or a trusted certifi‐
cate authority certificate from the keystore. Once removed, the
certificate and keys cannot be used.
listcert
Print details of one or more certificates in the keystore.
sync
Writes the contents file and rolls the contents log file. With use
of the -q option, forces the contents file server to quit.
Internal Install Database
The Solaris operating system relies upon enhanced System V revision 4
(SVr4) packages as the basis for its software installation and revision
management. The package maintenance software stores information about
installed packages in an internal database. The pkgadm subcomand dbsta‐
tus is used to determine how the package internal database is imple‐
mented. The dbstatus command returns a string that indicates the type
of internal database in use. In the current implementation, the dbsta‐
tus command always returns the string text, which indicates that the
contents(4) package database is inuse. Future releases of Solaris might
supply alternative database implementations.
OPTIONS
The following options are supported:
-a app
If this option is used, then the command only affects the keystore
associated with a particular application. Otherwise, the global
keystore is affected.
-e keyfile
When adding a non-trusted certificate/key combination, this option
can be used to specify the file that contains the private key. If
this option is not used, the private key must be in the same file
as the certificate being added.
-f format
When adding certificates, this specifies the format to expect cer‐
tificates and private keys in. Possible values when adding are:
pem
Certificate and any private key uses PEM encoding.
der
Certificate and any private key uses DER encoding.
When printing certificates, this specifies the output format used
when printing. Acceptable values for format are:
pem
Output each certificate using PEM encoding.
der
Output each certificate using DER encoding.
text
Output each certificate in human-readable format.
-k keystore
Overrides the default location used when accessing the keystore.
-n name
Identifies the entity in the store on which you want to operate.
When adding a user certificate, or removing certificates, this name
is required. The name is associated with the certificate/key combi‐
nation, and when adding, can be used later to reference the entity.
When printing certificates, if no alias is supplied, then all key‐
store entities are printed.
-o outfile
Output the result of the command to outfile. Only used when examin‐
ing (printing) certificates from the key store. Standard out is the
default.
-P passarg
Password retrieval method to use to decrypt keystore specified with
-k, if required. See PASS PHRASE ARGUMENTS in pkgadd(1M) for more
information about the format of this option's argument. console is
the default.
-p import_passarg
This option's argument is identical to -P, but is used for supply‐
ing the password used to decrypt the certificate and/or private key
being added. console is the default.
-q
(Applies to sync subcommand.) Shuts down the contents file cache
daemon.
-R rootpath
Defines the full name of a directory to use as the root (/) path.
The default user location of the certificate operations is
${HOME}/.pkg. If the -R option is supplied, the certificates and
keys will be stored under <altroot>/var/sadm/security. Note that
this operation fails if the user does not have sufficient permis‐
sions to access this directory. The listcert command requires read
permission, while addcert and removecert require both read and
write permission.
Note -
The root file system of any non-global zones must not be refer‐
enced with the -R option. Doing so might damage the global zone's
file system, might compromise the security of the global zone,
and might damage the non-global zone's file system. See zones(5).
-t
Indicates the certificate being added is a trusted CA certificate.
The details of the certificate (including the Subject Name, Valid‐
ity Dates, and Fingerprints) are printed and the user is asked to
verify the data. This verification step can be skipped with -y.
When importing a trusted certificate, a private key should not be
supplied, and will be rejected if supplied. Once a certificate is
trusted, it can be used as a trust anchor when verifying future
untrusted certificates.
-V
Print version associated with packaging tools.
-y
When adding a trusted certificate, the details of the certificate
(Subject name, Issuer name, Validity dates, Fingerprints) are shown
to the user and the user is asked to verify the correctness before
proceeding. With -y, this additional verification step is skipped.
-?
Print help message.
OPERANDS
The following operand is supported:
certfile
File containing the certificate and optional private key, used when
adding a trust anchor or certificate/key combination. Certificates
must be encoded using PEM or binary DER.
KEYSTORE ALIASES
All keystore entries (user cert/key and trusted certificate entries)
are accessed via unique aliases. Aliases are case-sensitive.
An alias is specified when you add an entity to a keystore using the
addcert or trustcert subcommand. If an alias is not supplied for a
trust anchor, the trust anchor's Common Name is used as the alias. An
alias is required when adding a signing certificate or chain certifi‐
cate. Subsequent pkgcert or other package tool commands must use this
same alias to refer to the entity.
KEYSTORE PASSWORDS
See the pkgadd(1M) man page for a description of the passwords supplied
to the pkgadm utility.
EXAMPLES
Example 1 Adding a Trust Anchor
The following example adds a well-known and trusted certificate to be
used when verifying signatures on packages.
example% pkgadm addcert -t /tmp/certfile.pem
Example 2 Adding a Signing Certificate
The following example adds a signing certificate and associated private
key, each of which is in a separate file, which can then be used to
sign packages.
example% pkgadm addcert -a pkgtrans -e /tmp/keyfile.pem \
/tmp/certfile.pem
Example 3 Printing Certificates
The following example prints all certificates in the root keystore.
example% pkgadm listcert
EXIT STATUS
0
successful completion
non-zero
fatal error
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
┌─────────────────────────────┬─────────────────────────────┐
│ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
├─────────────────────────────┼─────────────────────────────┤
│Availability │SUNWpkgcmdsu │
├─────────────────────────────┼─────────────────────────────┤
│Interface Stability │Evolving │
└─────────────────────────────┴─────────────────────────────┘
SEE ALSOpkginfo(1), pkgmk(1), pkgparam(1), pkgproto(1), pkgtrans(1), svcs(1),
installf(1M), pkgadd(1M), pkgask(1M), pkgrm(1M), removef(1M),
svcadm(1M), admin(4), contents(4), exec_attr(4), pkginfo(4),
attributes(5), rbac(5), smf(5)NOTES
The service for pkgadm is managed by the service management facility,
smf(5), under the service identifier:
svc:/system/pkgserv
Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using svcadm(1M). The service's
status can be queried using the svcs(1) command.
SunOS 5.10 20 Mar 2009 pkgadm(1M)
