pkgadm(1M)                                                                                                                              pkgadm(1M)

NAME

       pkgadm - manage packaging and patching system

SYNOPSIS

       pkgadm addcert [-ty] [-a app] [-k keystore] [-e keyfile] [-f format] [-n name] [-P passarg] [-p import_passarg] [-R rootpath] certfile

       pkgadm removecert [-a app] [-k keystore] -n name [-P passarg] [-R rootpath]

       pkgadm listcert [-a app] [-f format] [-k keystore] -n name [-P passarg] [-o outfile] [-R rootpath]

       pkgadm dbstatus [-R rootpath]

       pkgadm -V

       pkgadm -?

       The  pkgadm  utility  is  used  for  managing the packaging and patching system. It has several subcommands that perform various operations
       relating to packaging. The pkgadm command includes subcommands for managing certificates and keys used.

   Managing Keys and Certificates
       pkgadm maintains the packaging-system-wide keystore in /var/sadm/security, and individual user's certificates in ~/.pkg/security. The  fol-
       lowing subcommands operate on the package keystore database:

       addcert

           Add  (import) a certificate into the database, with optional trust. Once added, trusted certificates can be used to verify signed pack-
           ages and patches. Non-trusted user certificates and their associated keys can be used to sign packages and patches. Added user certifi-
           cates are not used to build certificate chains during certificate verification.

       removecert

           Removes  a  user certificate/private key pair, or a trusted certificate authority certificate from the keystore. Once removed, the cer-
           tificate and keys cannot be used.

       listcert

           Print details of one or more certificates in the keystore.

   Internal Install Database
       The Solaris operating system relies upon enhanced System V revision 4 (SVr4) packages as the basis for its software installation and  revi-
       sion management. The package maintenance software stores information about installed packages in an internal database. The pkgadm subcomand
       dbstatus is used to determine how the package internal database is implemented. The dbstatus command returns a string  that  indicates  the
       type  of internal database in use. In the current implementation, the dbstatus command always returns the string text, which indicates that
       the contents(4) package database is inuse. Future releases of Solaris might supply alternative database implementations.

       The following options are supported:

       -a app

           If this option is used, then the command only affects the keystore associated with a particular application. Otherwise, the global key-
           store is affected.

       -e keyfile

           When  adding  a  non-trusted certificate/key combination, this option can be used to specify the file that contains the private key. If
           this option is not used, the private key must be in the same file as the certificate being added.

       -f format

           When adding certificates, this specifies the format to expect certificates and private keys in. Possible values when adding are:

           pem             Certificate and any private key uses PEM encoding.

           der             Certificate and any private key uses DER encoding.

           When printing certificates, this specifies the output format used when printing. Acceptable values for format are:

           pem             Output each certificate using PEM encoding.

           der             Output each certificate using DER encoding.

           text            Output each certificate in human-readable format.

       -k keystore

           Overrides the default location used when accessing the keystore.

       -n name

           Identifies the entity in the store on which you want to operate. When adding a user certificate, or removing certificates, this name is
           required. The name is associated with the certificate/key combination, and when adding, can be used later to reference the entity. When
           printing certificates, if no alias is supplied, then all keystore entities are printed.

       -o outfile

           Output the result of the command to outfile. Only used when examining (printing) certificates from the key store. Standard out  is  the
           default.

       -P passarg

           Password  retrieval  method to use to decrypt keystore specified with -k, if required. See PASS PHRASE ARGUMENTS in pkgadd(1M) for more
           information about the format of this option's argument. console is the default.

       -p import_passarg

           This option's argument is identical to -P, but is used for supplying the password used to decrypt the certificate  and/or  private  key
           being added. console is the default.

       -R rootpath

           Defines  the  full  name  of  a  directory  to  use  as  the  root (/) path. The default user location of the certificate operations is
           ${HOME}/.pkg. If the -R option is supplied, the certificates and keys will be stored under <altroot>/var/sadm/security. Note that  this
           operation  fails  if the user does not have sufficient permissions to access this directory. The listcert command requires read permis-
           sion, while addcert and removecert require both read and write permission.

           Note -  The root file system of any non-global zones must not be referenced with the -R option. Doing so might damage the global zone's
                   file  system,  might  compromise  the  security  of  the  global  zone, and might damage the non-global zone's file system. See
                   zones(5).

       -t

           Indicates the certificate being added is a trusted CA certificate. The details of the certificate (including the Subject Name, Validity
           Dates,  and  Fingerprints)  are  printed  and the user is asked to verify the data. This verification step can be skipped with -y. When
           importing a trusted certificate, a private key should not be supplied, and will be rejected if supplied. Once a certificate is trusted,
           it can be used as a trust anchor when verifying future untrusted certificates.

       -V

           Print version associated with packaging tools.

       -y

           When  adding  a trusted certificate, the details of the certificate (Subject name, Issuer name, Validity dates, Fingerprints) are shown
           to the user and the user is asked to verify the correctness before proceeding. With -y, this additional verification step is skipped.

       -?

           Print help message.

       The following operand is supported:

       certfile

           File containing the certificate and optional private key, used when adding a trust anchor or certificate/key combination.  Certificates
           must be encoded using PEM or binary DER.

KEYSTORE ALIASES

       All keystore entries (user cert/key and trusted certificate entries) are accessed via unique aliases. Aliases are case-sensitive.

       An  alias  is  specified  when you add an entity to a keystore using the addcert or trustcert subcommand. If an alias is not supplied for a
       trust anchor, the trust anchor's Common Name is used as the alias. An alias is required when adding a signing certificate or chain certifi-
       cate. Subsequent pkgcert or other package tool commands must use this same alias to refer to the entity.

KEYSTORE PASSWORDS

       See pkgadd(1M) for a description of the passwords supplied to this utility.

       Example 1: Adding a Trust Anchor

       The following example adds a well-known and trusted certificate to be used when verifying signatures on packages.

       example% pkgadm addcert -t /tmp/certfile.pem

       Example 2: Adding a Signing Certificate

       The following example adds a signing certificate and associated private key, each of which is in a separate file, which can then be used to
       sign packages.

       example% pkgadm addcert -a pkgtrans -e /tmp/keyfile.pem 
       /tmp/certfile.pem

       Example 3: Printing Certificates

       The following example prints all certificates in the root keystore.

       example% pkgadm listcert

       0

           successful completion

       non-zero

           fatal error

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE         |      ATTRIBUTE VALUE        |
       +-----------------------------+-----------------------------+
       |Availability                 |SUNWpkgcmdsu                 |
       +-----------------------------+-----------------------------+
       |Interface Stability          |Evolving                     |
       +-----------------------------+-----------------------------+

       pkginfo(1), pkgmk(1), pkgparam(1), pkgproto(1), pkgtrans(1), installf(1M), pkgadd(1M), pkgask(1M), pkgrm(1M), removef(1M),  admin(4),  con-
       tents(4), exec_attr(4), pkginfo(4), attributes(5), rbac(5)

                                                                    6 Apr 2005                                                          pkgadm(1M)