System Administration Commands pkgadm(1M)
NAME
pkgadm - manage packaging and patching system
SYNOPSIS
pkgadm addcert [-ty] [-a app] [-k keystore] [-e keyfile]
[-f format] [-n name] [-P passarg]
[-p import_passarg] [-R rootpath] certfile
pkgadm removecert [-a app] [-k keystore] -n name
[-P passarg] [-R rootpath]
pkgadm listcert [-a app] [-f format] [-k keystore] -n name
[-P passarg] [-o outfile] [-R rootpath]
pkgadm dbstatus [-R rootpath]
pkgadm sync [-R rootpath] [-q]
pkgadm -V
pkgadm -?
DESCRIPTION
The pkgadm utility is used for managing the packaging and
patching system. It has several subcommands that performvarious operations relating to packaging. The pkgadm command
includes subcommands for managing certificates and keys used. Managing Keys and Certificatespkgadm maintains the packaging-system-wide keystore in
/var/sadm/security, and individual user's certificates in ~/.pkg/security. The following subcommands operate on the package keystore database: addcert Add (import) a certificate into the database, with optional trust. Once added, trusted certificates can beused to verify signed packages and patches. Non-trusted
user certificates and their associated keys can be used to sign packages and patches. Added user certificatesare not used to build certificate chains during certifi-
cate verification.SunOS 5.11 Last change: 20 Mar 2009 1
System Administration Commands pkgadm(1M)
removecert Removes a user certificate/private key pair, or atrusted certificate authority certificate from the key-
store. Once removed, the certificate and keys cannot be used. listcertPrint details of one or more certificates in the key-
store. sync Writes the contents file and rolls the contents logfile. With use of the -q option, forces the contents
file server to quit. Internal Install Database The Solaris operating system relies upon enhanced System V revision 4 (SVr4) packages as the basis for its softwareinstallation and revision management. The package mainte-
nance software stores information about installed packagesin an internal database. The pkgadm subcomand dbstatus is
used to determine how the package internal database is implemented. The dbstatus command returns a string that indicates the type of internal database in use. In the current implementation, the dbstatus command always returnsthe string text, which indicates that the contents(4) pack-
age database is inuse. Future releases of Solaris might sup-
ply alternative database implementations. OPTIONS The following options are supported:-a app
If this option is used, then the command only affects the keystore associated with a particular application. Otherwise, the global keystore is affected.-e keyfile
When adding a non-trusted certificate/key combination,
this option can be used to specify the file that con-
tains the private key. If this option is not used, the private key must be in the same file as the certificate being added.SunOS 5.11 Last change: 20 Mar 2009 2
System Administration Commands pkgadm(1M)
-f format
When adding certificates, this specifies the format to expect certificates and private keys in. Possible values when adding are: pem Certificate and any private key uses PEM encoding. der Certificate and any private key uses DER encoding. When printing certificates, this specifies the output format used when printing. Acceptable values for format are: pem Output each certificate using PEM encoding. der Output each certificate using DER encoding. textOutput each certificate in human-readable format.
-k keystore
Overrides the default location used when accessing the keystore.-n name
Identifies the entity in the store on which you want to operate. When adding a user certificate, or removingcertificates, this name is required. The name is associ-
ated with the certificate/key combination, and when adding, can be used later to reference the entity. When printing certificates, if no alias is supplied, then all keystore entities are printed.SunOS 5.11 Last change: 20 Mar 2009 3
System Administration Commands pkgadm(1M)
-o outfile
Output the result of the command to outfile. Only used when examining (printing) certificates from the key store. Standard out is the default.-P passarg
Password retrieval method to use to decrypt keystorespecified with -k, if required. See PASS PHRASE ARGU-
MENTS in pkgadd(1M) for more information about the for-
mat of this option's argument. console is the default.-p import_passarg
This option's argument is identical to -P, but is used
for supplying the password used to decrypt the certifi-
cate and/or private key being added. console is the default.-q
(Applies to sync subcommand.) Shuts down the contents file cache daemon.-R rootpath
Defines the full name of a directory to use as the root (/) path. The default user location of the certificateoperations is ${HOME}/.pkg. If the -R option is sup-
plied, the certificates and keys will be stored under/var/sadm/security. Note that this operation fails if the user does not have sufficient permissions to access this directory. The listcert command requires read permission, while addcert and removecert require both read and write permission. Note -
The root file system of any non-global zones must not
be referenced with the -R option. Doing so might dam-
age the global zone's file system, might compromise the security of the global zone, and might damage thenon-global zone's file system. See zones(5).
-t
SunOS 5.11 Last change: 20 Mar 2009 4
System Administration Commands pkgadm(1M)
Indicates the certificate being added is a trusted CA certificate. The details of the certificate (including the Subject Name, Validity Dates, and Fingerprints) are printed and the user is asked to verify the data. Thisverification step can be skipped with -y. When importing
a trusted certificate, a private key should not be sup-
plied, and will be rejected if supplied. Once a certifi-
cate is trusted, it can be used as a trust anchor when verifying future untrusted certificates.-V
Print version associated with packaging tools.-y
When adding a trusted certificate, the details of the certificate (Subject name, Issuer name, Validity dates, Fingerprints) are shown to the user and the user is asked to verify the correctness before proceeding. With-y, this additional verification step is skipped.
-?
Print help message. OPERANDS The following operand is supported: certfile File containing the certificate and optional private key, used when adding a trust anchor or certificate/key combination. Certificates must be encoded using PEM or binary DER. KEYSTORE ALIASES All keystore entries (user cert/key and trusted certificateentries) are accessed via unique aliases. Aliases are case-
sensitive. An alias is specified when you add an entity to a keystore using the addcert or trustcert subcommand. If an alias is not supplied for a trust anchor, the trust anchor's Common Name is used as the alias. An alias is required when adding a signing certificate or chain certificate. SubsequentSunOS 5.11 Last change: 20 Mar 2009 5
System Administration Commands pkgadm(1M)
pkgcert or other package tool commands must use this same alias to refer to the entity. KEYSTORE PASSWORDSSee the pkgadd(1M) man page for a description of the pass-
words supplied to the pkgadm utility.
EXAMPLES
Example 1 Adding a Trust AnchorThe following example adds a well-known and trusted certifi-
cate to be used when verifying signatures on packages.example% pkgadm addcert -t /tmp/certfile.pem
Example 2 Adding a Signing CertificateThe following example adds a signing certificate and associ-
ated private key, each of which is in a separate file, which can then be used to sign packages.example% pkgadm addcert -a pkgtrans -e /tmp/keyfile.pem \
/tmp/certfile.pem Example 3 Printing Certificates The following example prints all certificates in the root keystore.example% pkgadm listcert
EXIT STATUS 0 successful completionnon-zero
fatal errorSunOS 5.11 Last change: 20 Mar 2009 6
System Administration Commands pkgadm(1M)
ATTRIBUTES
See attributes(5) for descriptions of the following attri-
butes:____________________________________________________________
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
|_____________________________|_____________________________|
| Availability | package/svr4 ||_____________________________|_____________________________|
| Interface Stability | Committed ||_____________________________|_____________________________|
SEE ALSO
pkginfo(1), pkgmk(1), pkgparam(1), pkgproto(1), pkgtrans(1), svcs(1), installf(1M), pkgadd(1M), pkgask(1M), pkgrm(1M), removef(1M), svcadm(1M), admin(4), contents(4),exec_attr(4), pkginfo(4), attributes(5), rbac(5), smf(5)
NOTESThe service for pkgadm is managed by the service management
facility, smf(5), under the service identifier: svc:/system/pkgserv Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using svcadm(1M). The service's status can be queried using the svcs(1) command.SunOS 5.11 Last change: 20 Mar 2009 7