Re: pkgbase repo signing infrastructure

On 30 Nov 2025, at 2:42, Sulev-Madis Silber wrote:

> i've always wanted to know how fbsd signs all things it releases. apparently it's kind of like i imagined. that would show i'm not bad at security i guess :p

Good cryptographic usage should be obvious. Clever crypto usage is usually problematic.

> but to this day, i'm wondering how all that actually gets released. like what scripts actually create it all, releases, packages, etc. sync to mirrors, etc
>
> i don't mean things in release/
>
> to this day i've seen only bits
>
> so what security officer thinks, can those be shared? supposedly they are in private repo(s), i heard and "not very interesting"

The freebsd-update scripts are mostly up to date here without the per-release configuration files:
https://github.com/freebsd/freebsd-update-build/

It doesn’t include the mirror distribution pieces, but I don’t have visibility into the details there. The clusteradm team takes care of all that.

As I cited in the original email, the pkgbase stuff is well documented by cperciva. The instructions make it clear how it all fits together:
https://github.com/cperciva/pkgbase.freebsd.org/blob/main/INSTRUCTIONS

This includes uploading the assets to an S3 bucket fronted with CloudFront for distribution.

> i mean, if there are any _secrets_ in there, it would be about last time for those secrets be separated from tools so the rest could be shared. maybe that even helps finding bugs as amount of eyes increases a lot
>
> those things could be even documented. i mean after all fbsd handbook and manpages are already world class information sources for sysadmin knowledge. which i've read and praised since 2002 when i installed my first fbsd, a 4.6

Operational scripts that are specific to the FreeBSD infrastructure frankly aren’t that useful outside of that infrastructure. Usually, they tend to be a bit embarrassing in how they are constructed as well (bubble gum and duct tape).

An overall talk or discussion on how the FreeBSD infrastructure is put together might be an interesting conference topic. I’m not qualified to give it.

Gordon